Conga CLM vs Contractbook: how they compare in 2026
Conga is the broader fit when contracting forms part of a larger quoting, pricing and revenue process. Its Salesforce edition and Advantage Platform offer different starting points, and CPQ, Composer and Sign connect commercial data to contract production and execution. Contractbook concentrates on the contract workspace itself, with a defined path from imported agreements to verified fields and from HubSpot deals to signed contract records. Both provide AI extraction, contract questions and human review inside a full lifecycle product. Conga's implementation can involve several suite products and business systems, while Contractbook organizes subscriptions around plan allowances. Neither current pricing page gives a base subscription amount. The practical distinction is the surrounding business process, a commercial operations suite or a contract workspace connected to CRM data.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
AiMe is a shared AI layer across the commercial suite. It connects workflow data across CPQ, CLM, price optimization and document automation and suggests next steps, rather than being the CLM itself. Underneath sits a full contract lifecycle platform that long predates it, with template and clause library generation, approval routing, negotiation, electronic signature through Conga Sign, a searchable repository, obligation and renewal tracking, and reporting. The models drive core features on top of that platform. Without AiMe a working CLM remains, as the edition built on Salesforce was for years. Recent releases push AI further in. The June 2026 release extends AI across the platform, including bulk import and extraction for incoming contracts. The March 2026 AiMe release adds agents that act inside quoting and contracting workflows. Conga still sells and prices the platform as a contract system with intelligence on top.
AI Import reads existing contracts, extracts structured fields and helps turn a collection of files into a usable agreement database. The Contract Assistant adds plain language questions, summaries, risk identification and clause revisions. Both operate inside a wider application with template drafting, collaboration, electronic signatures and ongoing contract management. Templates and configured workflows still handle repeat agreements independently of the assistant. Customers can combine the extracted dates and obligations with reminders, while CRM data populates new agreements. Essential includes the assistant; higher plans add broader data extraction, custom fields, automation and team administration around these AI functions.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
The AI pipeline divides document processing among specialized providers. Google Cloud Vision handles optical character recognition, Amazon Textract table detection, Zuva provision extraction and Azure OpenAI language processing. Output is grounded in the customer's own repository, playbook and clause library, and extraction needs no model training by the customer. AiMe shows how every recommendation is generated, with the reasoning visible and confidence scores wherever it makes a suggestion. The Artificial Intelligence Addendum addresses accuracy only through a disclaimer. It states that outputs may be inaccurate, incomplete or misleading and disclaims any warranty of accuracy or completeness. No accuracy figure, test set, error rate or benchmark result is available. Third party models undergo benchmarking before release, without disclosed results. The product cites no legal authority, so grounding in authority and citator checks do not apply.
AI Import connects extracted data to the text it came from. Selecting a purple field in the sidebar moves the reader to its exact location in the original agreement and highlights the passage. Users can inspect individual values or verify all fields together, and the repository marks completed verification. Import first processes the uploaded files and extracts their contract data, with OCR included for relevant files. This is source based verification of customer agreements, rather than a legal citator. No test set, measured accuracy result or explicit unsupported answer behavior accompanies the Contract Assistant's broader clause recommendations.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Conga states that AiMe never acts autonomously on high stakes decisions. Three mechanisms constrain it, agent guardrails, approval thresholds and human in the loop confirmation, and each can be built into a workflow. AiMe shows how every recommendation is generated and the reasoning behind AI driven actions. Confidence scores appear wherever it makes a suggestion, users accept or reject redlines, and every action and approval is kept in an audit trail. Much of the oversight model is written into the contract. The Artificial Intelligence Addendum makes the customer solely responsible for evaluating and validating outputs. It says the customer must not rely on AI outputs as the sole basis for any decision with legal, financial, regulatory or other material impact. It also requires human review and independent judgment, and puts authorizing and supervising agent actions on the customer. The guardrails and thresholds are described as configurable rather than as defaults, and the same document states that Conga does not monitor or review AI generated outputs.
An AI import can be canceled during upload, OCR or extraction, and the canceled file is discarded. After processing, a reviewer checks the proposed data against highlighted source text and marks the fields verified. That verification can become the trigger for a reminder or a move into a shared space. Users need the relevant company permissions to import files and manage custom contract types. Template workflows also support approval steps before signing. These controls give teams review and cancellation surfaces, but the assistant has no stated confidence cutoff or defined escalation path for an answer that cannot be supported.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Cotality, formerly CoreLogic, describes improving client service with Conga CLM in a September 2024 customer story without a quantified outcome. Two other dated stories, DigiKey on price management and Kalixia at 160 times faster document generation, concern other Conga products. Other named customers include Southwest Airlines, LinkedIn, AXA, Peloton, Cotality, T-Mobile, Adobe, Box and Kraft Heinz. The headline improvement figures are separate from those named customers. A 9 percent revenue increase appears beside the logo strip with no stated basis, and Conga claims 50 percent less review time with AI. Conga also cites G2 Leader recognition across five grids.
Bizzkit's compliance officer describes saving 15 to 20 hours extracting data from about 50 legacy data processing agreements. That is a named example of AI extraction in use, with the time estimate supplied by the customer. Lenus separately describes reducing contract preparation from 15 minutes to five through templates and integrations with Salesforce, Greenhouse and HiBob. Those automation results are not presented as a measurement of the newer Contract Assistant. GANNI and Pave also discuss repository and extraction benefits. No dated comparative study isolates the assistant's effects on review quality or legal outcomes.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Under the Artificial Intelligence Addendum, Conga will not use AI Inputs or AI Outputs to train or improve any model beyond a limited license to provide, maintain or improve the Services for that customer. Customer Data will not train global or foundational models serving multiple customers, and no third party may use Customer Data or AI Output to train, fine tune, validate, test or develop any model. Tenants are logically separated with dedicated encryption keys. The Data Processing Addendum limits retention to the time absolutely necessary and requires return and deletion at the customer's election after the agreement ends. Prompts, completions, embeddings and training data sent to Azure OpenAI are not available to OpenAI and are not used to improve OpenAI, Microsoft or third party products. Each document processing provider works under a zero retention arrangement. Conga sells the product to legal departments to hold their agreements, and its addenda, trust center and product pages do not address attorney client privilege or work product. Separate contractual conditions sit in Conga's Master Services Agreement.
Section 9.12 of the service terms bars AI model training on retained platform data unless the customer gives consent in writing or through the application. Confidential information is limited to service delivery and remains protected after termination. AI imports start in the user's private contract view, while sharing depends on the application's space permissions. Google Cloud hosts platform data and Azure hosts the language model, both with EU locations in the processor list. Privilege and work product handling are not addressed directly, and the terms do not specify what the model provider retains from individual prompts or responses.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Conga's position on advice versus tooling sits in the Artificial Intelligence Addendum. The Addendum states that AI generated outputs may be inaccurate, incomplete or misleading, disclaims any warranty of fitness, and makes the customer solely responsible for validating outputs before use. It says the customer must not rely on AI outputs as the sole basis for any decision with legal, financial, regulatory or other material impact, and that human review and independent judgment should be exercised. It applies the same rule to agents, making the customer responsible for deciding whether agent actions are appropriate and for authorizing and supervising them. Legal, sales and procurement teams use the application as a contracting tool. The service does not specify how a supervising lawyer meets competence or oversight duties over AI drafted contract language. Capability restrictions by buyer group and jurisdictional limits are not specified. The product is marketed to sales and procurement users who generate contract positions in the same tenant as legal.
The service is restricted to business activity and is not offered to consumers. Section 8 describes the supplied templates as drafting inspiration rather than legal advice, and the company profile makes the same tooling distinction for the product. Legal teams can control templates, approvals and shared spaces while other employees generate routine agreements. The customer remains responsible for using suitable agreements and deciding whether electronic signatures are appropriate. No jurisdiction specific competence guidance or named professional supervision standard accompanies the assistant. Its explanation and rewriting features therefore sit inside the customer's own legal review and contracting responsibilities.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Conga's AI governance framework sits in the Artificial Intelligence Addendum rather than on a principles page. The Addendum records a cross functional AI Governance Committee responsible for oversight of AI within the Services. The committee focuses on risk management, accountability and compliance, and periodically reviews AI risks, controls and mitigations. Conga commits to internal policies on responsible AI covering oversight of training data, bias mitigation and human interpretability, to staff training, and to full cooperation with a customer's own AI impact assessments. Governance is tied to the NIST AI Risk Management Framework and its four functions, Govern, Map, Measure and Manage. The vendor classifies its products as minimal or limited risk AI systems under the EU AI Act. It states that third party models are tested, audited for bias and benchmarked before release, with rollback to any prior model version within hours. Results from that testing, bias audit findings, evaluation outputs and model cards are not available, including performance differences across contract types.
Contractbook's trust center describes security policies, change management and an incident response program. Management reviews that security program at least annually, and production data is restricted in development and testing environments. The AI features separately support source highlights, user verification and consent for model training. None of these materials sets out an AI release evaluation process, a responsible AI framework or results showing uneven performance across contract types or user groups. The page titled AI Policy Page is a company and product profile for automated readers, rather than a policy assigning accountability for the behavior of the language model.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The Data Processing Addendum says retention of personal data should generally not be required and is limited to the time absolutely necessary to perform the Services. Daily backups are kept for thirty days, and each third party document processing provider works under a stated zero retention arrangement. Data is returned or deleted at the customer's election within a reasonable period after the agreement ends, and the CCPA attachment requires prompt compliance with deletion requests. Access controls include role based authorization, least privilege, quarterly access reviews, multifactor authentication, encryption at rest, TLS of 256 bits or stronger in transit, and per tenant encryption keys. The subprocessor terms provide fifteen days' notice before additions, a right to object with termination and refund, and Conga's responsibility for provider acts. Incident notice comes within 48 hours of Conga becoming aware, backed by a response plan with root cause analysis and a 24/7 security team.
Customers can remove or archive their own data through the application and request removal at termination. Signature verification information has separate retention rules and generally requires all signers' consent before deletion. The privacy policy gives a general service data retention period with legal exceptions, while the processor list identifies providers, roles and locations. Space permissions, encrypted storage, logging and a trust center incident plan add operational controls. Confidentiality breaches require prompt notice under the terms. A specific retention window for assistant prompts and outputs, together with a deletion schedule at the model host, is not stated.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The Artificial Intelligence Addendum states that Conga makes no warranty, express or implied, on the accuracy, completeness, noninfringement or fitness for purpose of AI generated output. The customer is solely responsible for evaluating and validating that output. To the maximum extent permitted by law, Conga is not liable for any losses, damages or claims arising from the customer's use of or reliance on AI output or on actions by agentic AI features. That includes third party claims. One allocation runs the other way. The Data Processing Addendum makes Conga liable for its subprocessors' acts and omissions as if it had performed the services itself, and much of the AI pipeline sits with those third parties. The addenda do not state a general liability cap, an indemnity scope or an insurance position. Conga's Master Services Agreement is a separate document.
The service agreement limits liability to fees paid in the 12 months before the first claim arose. It excludes lost profit, business opportunity, third party liabilities, data loss and several other categories of loss, and supplies the service as is. Death or personal injury caused by negligence, fraud and fraudulent misrepresentation are outside the stated limitations. The customer, rather than the vendor, gives the agreement's indemnity. Contractbook promises customary insurance without naming its amount or scope. These provisions do not provide a specific warranty or recovery route for a mistaken AI clause explanation, extraction or revision.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Several of Conga CLM's integrations are structural. One edition runs natively on Salesforce and is listed on the Salesforce AppExchange. Authoring and review run inside Microsoft Word and Google Docs, and Microsoft Dynamics is named on the product page. The platform edition supports connections to CRM, ERP and procurement systems. Within Conga's own products, pricing, terms and configurations flow from CPQ into a contract. Documents are generated through Composer and signed through Conga Sign, and price optimization feeds contract pricing. Developer resources cover APIs and integrations. Field mapping and sync directions for individual external connectors are not specified alongside the broader connections.
The HubSpot integration moves deal and company data into contract templates and can synchronize negotiated values back after signing. Setup requires defined template fields, the appropriate Contractbook template or company permissions, and specified HubSpot CRM, product library and marketplace rights. The administrator connects the accounts through Integrations and accepts the requested permissions, then configures triggers and actions. HubSpot quotes can become attachments, and its widget displays contract status and activity. Disconnecting unpublishes related automations without deleting generated files. Salesforce, API access, Zapier and Make extend other workflows, with availability and charges varying by plan.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The CLM has two delivery forms. One is the original application built on Salesforce. The other is a software as a service edition on the Conga Advantage Platform that gives buyers a CLM interface independent of Salesforce. The Data Processing Addendum treats them differently. It states that Conga does not back up customer data for services hosted on Salesforce and sets no recovery point objective for them. Elsewhere it keeps daily backups for thirty days, with a one hour recovery point objective and a twenty four hour recovery time objective. Infrastructure is named as Salesforce, Amazon Web Services and Azure, with data on servers managed by Salesforce and AWS. Each logical tenant boundary has its own encryption key. Availability is described as spanning the United States, the European Union and Asia Pacific with residency options included, which names continents rather than regions. A region list, the method of choosing a tenant's region and separate processing locations are not specified. Content reaches Azure OpenAI, Google Cloud Vision, Amazon Textract and Zuva, and the processing locations are not specified.
Contractbook runs as an online contract workspace with organization accounts, shared spaces and individual access rights. The subprocessor list places Google Cloud platform hosting and Azure language model hosting in the EU. It also identifies United States services for email, messaging, monitoring, traffic management and integrations, so the EU hosting entries do not describe every supporting data flow. The privacy policy permits transfers outside the EU and EEA with safeguards. No country selection, customer hosted installation or private tenancy option is specified, and the available material does not allocate storage and processing locations separately for each subscription plan.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
SOC 2 Type II covers the full platform under annual audits, according to Conga. The trust center also lists ISO 27001, ISO 27701 as its privacy extension, PCI DSS, HIPAA Security with annual audits, GDPR and CCPA. It adds alignment to the NIST AI Risk Management Framework and certification under the EU-U.S. Data Privacy Framework. The Data Processing Addendum links that certification to the Department of Commerce register. The security program includes annual third party penetration testing, application vulnerability assessment twice a year, continuous automated threat hunting and code analysis before release. It also covers a patching service level by severity, background checks, annual security training and a vulnerability disclosure program. Auditor names, report periods, observation windows and certificate numbers are not available alongside those claims, and reports require a request. The Data Processing Addendum makes reports available on a customer's request under confidentiality, so a prospective buyer cannot read the audit scope before signing.
The security page states SOC 2 compliance and describes recurring penetration tests, encrypted credentials, verified accounts and two factor signing. A Secureframe trust center offers a SOC 2 report through a request control and lists security policies covering access, change management, risk and incident response. Its public material does not identify the assessment period, report type, auditor or detailed system scope. The separate Openli profile could not be accessed, so any material there remains unknown. Customer signatures and identity controls support contract execution, while the SOC 2 claim addresses service controls rather than measured accuracy of the AI assistant.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Generative features run on Microsoft Azure OpenAI. The document processing agents also use Google Cloud Vision for optical character recognition, Amazon Textract for table detection and Zuva for provision extraction, each under a stated zero retention arrangement. The Azure OpenAI Service is described as fully controlled by Microsoft, hosted in Microsoft's own Azure environment and not interacting with any system operated by OpenAI. Prompts, completions, embeddings and training data are tokenized in transit, are not available to OpenAI, and are not used to improve OpenAI, Microsoft or third party models. Change notice is contractual. The AI providers are subprocessors, and the Data Processing Addendum gives fifteen days' notice before a new one is appointed, with its name, location and activity. It also gives a right to object, and termination with a refund if no workaround exists. No specific model is named. The Addendum refers to Azure OpenAI GPT, which is a family rather than a version, and nothing states which model writes a summary or a redline or when that changes.
Microsoft Azure hosts the large language model used for the product's AI functions, with the processor list assigning that service an EU location. Google Cloud is separately responsible for storage and platform hosting. The application combines document import, OCR, field extraction and a conversational contract assistant, but the specific model name and version are not identified. The terms require customer consent before retained platform data is used for model training. A general notice rule for contractual updates does not provide a specific commitment to notify customers about model replacements or changes to the inference supply chain.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Conga CLM uses custom quotes without a numeric starting rate, a defined billing unit or a plan table. The application combines drafting, negotiation, approvals, electronic signature, contract storage and obligation management, with AI review and extraction inside that workflow. Additional products connect CPQ, document generation and signing to the wider suite. An advanced CLM feature set includes clause libraries, version control and redlining, but its incremental charge is not specified. Subscription duration, renewal provisions, price increase limits and implementation fees are not given with the quote request. The Master Services Agreement is separate from the AI and data processing addenda.
Essential, Centralize and Accelerate include one, five and ten users, with annual signed contract allowances of 100, 350 and 500. Template limits are five, 15 and 25. The current pricing page shows no base subscription amount; a company profile updated in March 2026 gives a starting rate of €89 per month. The pricing FAQ lists five extra users at €50 per month, or €600 annually. Automation and provisioning are optional for Centralize and included in Accelerate, while several integrations cost extra. Custom setup uses a quote, and the terms provide for upgrades or additional charges when usage limits are exceeded.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Legal, procurement, sales, finance, IT, business operations and pricing teams use the suite. Their CLM tasks differ. Legal gets workflow, authoring, AI review and redlining, compliance and risk management. Procurement gets obligation management, AI extracted terms and pricing. Sales gets generation, AI assisted negotiation and renewals. Industry uses cover technology, financial services, healthcare, life sciences, manufacturing, transport and logistics, and distribution. Named customers span airlines, insurance, media, retail and property data. No practice area inside a legal department is named as supported or unsupported, and nothing states what the product is not for. Capability restrictions for users who are not lawyers are not specified inside a shared tenant. Jurisdiction and language coverage boundaries are also unspecified, although the product is localized into German and French.
Small and midsize sales, legal, HR and operations teams use the platform for standard recurring agreements such as NDAs, sales contracts and employment agreements. The Lenus case describes legal counsel setting templates and boundaries for colleagues across several markets. Bizzkit uses extraction for legacy data processing agreements, while GANNI and Pave describe contract visibility and renewal work. The company focuses on European markets and also offers industry pages for government, healthcare, construction and procurement. Its own profile excludes legal advice and simple one off signing as its intended role, without supplying a jurisdiction by jurisdiction support matrix.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The Artificial Intelligence Addendum expressly permits training on customer content, within written limits. Section (c) says Conga will not use Customer Data to train global or foundational models that serve multiple customers. Any training on Customer Data is limited to models specific to the customer's instance or tenant. Permitted training is limited to the customer's own data and a model only that customer uses, and neither the Addendum nor the trust center describes an opt out.
Conga does not use Customer Data to train third party foundational models, naming Azure OpenAI GPT as the example. Section (d) says Conga will not let any third party use Customer Data or AI Output to train, fine tune, validate, test or otherwise develop any AI model. Section (b) says that, beyond a limited license to provide, maintain or improve the Services for that customer, Conga will not use AI Inputs or AI Outputs to train or improve any model.
The trust center adds that models trained on one customer's data are never used for another. One carve out is reserved. Service Attributes, defined as anonymized and aggregated usage information, may be used to train and refine models and are stated not to be Customer Data.
Section 9.12 prohibits use of retained platform data for AI model training unless the customer consents in writing or through the platform. Section 9.1 separately refers to anonymized development data where consent has been given. The general service processing license covers delivery, maintenance, fixes, security and legal obligations. It does not override the express training consent requirement, and no default training permission is stated for a new customer.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
The Data Processing Addendum lets the customer control retention by contractual instruction. Attachment A sets the default. Retention of personal data should generally not be required, and any retention is limited to the time absolutely necessary to perform the Services. Section 9.6 requires return and deletion at the customer's election within a reasonable period after the agreement ends, with the customer deleting within the Services and Conga helping where it cannot.
The CCPA attachment adds a duty to follow any customer deletion instruction promptly. Daily backups are kept for thirty days, except for services hosted on Salesforce, which Conga does not back up. At the model layer, Conga states a zero retention policy with each third party document processing provider. Documents sent to Azure OpenAI, Google Cloud Vision, Amazon Textract and Zuva are therefore processed in real time and not stored. No zero retention setting is offered to the customer inside the Services.
Customers may remove or archive their data at any time through the platform under section 9.4, and may request removal of their own data when the agreement ends. Signature verification information follows a separate rule requiring signer consent. The privacy policy supplies a broader service data retention period with legal exceptions. No explicit zero retention setting or separate fixed period for assistant prompts and answers is specified.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Conga CLM has its own permission model, which the customer administers. Between customers, separation is built into the architecture. Tenant environments are logically separated, each with its own encryption keys, and models trained on one customer's data are never used for another customer's recommendations or scores. Inside a tenant, the Data Processing Addendum's security attachment requires role based authorization, least privilege, quarterly access reviews, multifactor authentication and the customer's ability to limit access to authorized personnel.
Rules based access controls, audit logs and admin tools help the customer configure and manage AiMe, which leaves the alignment work with the customer. The product does not apply an outside document management system's access model at query time. The addenda and trust center do not address segregation between matters or business units inside one tenant. The platform is sold to legal, procurement, sales, finance and IT in the same instance, and the assistant answers questions across the whole contract repository.
AI imports are private in the importing user's contract view until shared directly or moved to a shared space. Space access separates viewing, contract management and space management, while external collaborators receive view rights only. Company user groups can also receive access, with direct permissions surviving removal from a group. This is Contractbook's own access model, without an identified connection that inherits a firm's document system ethical walls.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 4 of the Data Processing Addendum's security attachment is headed Disclosure by Law. If Conga is required by law to disclose customer data, it will notify the customer as soon as practical where the law permits. It will also take all steps to give the customer an opportunity to prevent or limit the disclosure, an obligation to help and not only to inform. The CCPA attachment adds a slightly stronger commitment for personal information.
For a legally required disclosure unrelated to the contracted business purpose, Conga must first tell the customer and give it a chance to object or challenge the requirement, unless the law prohibits notice. Conga will also redirect a misdirected data subject request to the customer and will not respond without the customer's prior written consent unless legally required. No transparency report, aggregate demand count or reporting cadence is available.
Section 9.8 requires written notice before legally compelled disclosure whenever possible. The confidentiality clauses also permit information to be supplied to other signers of an agreement completed through the platform. The privacy policy covers legal obligations and requests from authorities. No transparency report accompanies these commitments. The separate Disclosure Policy concerns security vulnerability reporting and does not describe the handling of subpoenas or other demands for customer contracts.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Conga CLM works from the customer's own material. That means contracts imported in bulk, including third party, legacy and acquired agreements, plus the customer's clause library, negotiation playbook and approved templates. The vendor states that precise models are built from the customer's own documents without the customer having to train them. The generative layer is named too. Azure OpenAI handles language processing, with Google Cloud Vision, Amazon Textract and Zuva for optical character recognition, table detection and provision extraction.
Conga states no rights basis for any of these sources and does not describe what the underlying foundation models were trained on. Zuva's extraction models are trained on contract collections rather than on the customer's documents, and they are named without any account of what sits behind them. On the customer's side, the Artificial Intelligence Addendum leaves the customer with all right, title and interest in its AI Inputs and AI Outputs and grants Conga only a limited license.
AI Import processes the customer's legacy agreements and points extracted fields back to text in those files. The contract assistant also works with the selected agreement, while customers can create templates or use the vendor's template library. No licensed case law or statute collection is identified for those functions. The supplied templates are drafting material, and the agreement expressly distinguishes them from legal advice for the customer's situation.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
The product cites no cases, statutes or regulations, so checking authority for later history does not arise in its usual form. It works on the customer's own agreements, comparing drafts to a negotiation playbook, matching against an approved clause library, extracting obligations and dates, summarizing, and answering questions about the repository. Nothing it produces is a statement about the law that a lawyer would check for later treatment.
The nearest point is obligation and renewal tracking, where the question is whether a contractual date or duty is still live, and alerts and dashboards handle that. No feature checks legal authority for subsequent history.
The platform's verification feature checks extracted information against the source contract, with highlighted passages and a completed verification marker. It does not track judicial treatment of cases or statutory amendments. The assistant can explain and rewrite clauses, but no connection to a legal citator or warning that an authority has been overturned is specified. Renewal reminders and signature status concern the agreement's lifecycle, rather than the legal status of an authority.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Conga commits that AiMe shows how every recommendation is generated, that users see the reasoning behind AI driven actions, and that confidence scores appear wherever AiMe makes a suggestion. That gives a reviewer a signal for each suggestion. Conga does not describe what the system does when it cannot ground an answer. An explicit refusal response or unsupported extraction marker is not specified. Nor does it say what happens when a clause cannot be matched to the playbook or a question cannot be answered from the repository.
No evaluation results for that behavior are available. The Artificial Intelligence Addendum allocates the consequences instead. It says outputs may be inaccurate, incomplete or misleading, makes the customer solely responsible for validating them, and states that Conga does not monitor or review AI generated outputs. The precise behavior of the guardrails is not specified.
Reviewers can inspect AI extracted fields beside highlighted source passages and verify them individually or together. They can also cancel an import during processing, which discards the file. These controls let a person check the extraction, but no explicit unsupported answer response or confidence indicator is described for the conversational assistant. The option to stop an upload is a user action, not a model refusal when information is insufficient.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin tracks decisions worldwide where a court addressed hallucinated AI content, and records the tool implicated where known. It records no court order, opinion or disciplinary record naming Conga CLM or Conga. Two independent sanctions trackers of decisions on AI generated fabricated citations do not name them either. Conga CLM works on contracts and cites no legal authority, so its output does not ordinarily reach a court filing.
No court order or disciplinary record concerning fabricated legal citations from Contractbook appears in the AI Hallucination Cases database. The product extracts data from customer agreements and offers questions, summaries and clause revisions within its contract workspace. That database result does not measure extraction or drafting accuracy. Its source highlights support a user's review of contract data, without constituting a check of every legal assertion produced by the assistant.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No bar or ethics guidance is named for the service. ABA Formal Opinion 512 does not appear, no state guidance on generative AI in legal practice is referenced, and nothing maps a capability to a jurisdiction's rules of professional conduct. Conga does cite outside frameworks, but none of them is professional responsibility guidance. The Artificial Intelligence Addendum ties governance to the NIST AI Risk Management Framework, and the trust center classifies the products as minimal or limited risk AI systems under the EU AI Act.
Both are addressed to the vendor as an AI provider. The nearest thing to a professional responsibility statement is the Addendum's requirement that the customer not rely on AI outputs as the sole basis for a decision with legal impact. It also requires the customer to exercise independent judgment. It names no guidance.
The service terms limit the platform to business users and explain that the template library does not provide legal advice. Legal departments can control templates, permissions and review steps for other employees. No named bar opinion, jurisdiction specific competence requirement or product mapping to professional ethics guidance accompanies these controls. The statement that the service is a business tool does not specify how a lawyer should record supervision of its AI functions.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product serves corporate teams managing their own commercial agreements. The named audiences are in house functions, legal, procurement, sales, finance, IT and business operations, each with its own page. The named customers are corporate, among them an airline, an insurer, a property data business, a consumer fitness company and a professional network. Nothing is addressed to a law firm billing a client. Conga's efficiency claims include a 9 percent revenue increase, 50 percent less review time with AI, faster deal cycles and lower supplier costs.
All of them concern the buyer's own cost, cycle time or revenue, and none reaches a client bill. The platform also runs quoting, pricing and billing, but that is the customer billing its own customers rather than a lawyer billing a client. No client fee disclosure workflow for AI assistance is specified.
The stated buyers are business teams managing their own sales, employment, supplier and compliance agreements. Named legal customers include internal counsel at Lenus, GANNI and Pave, and the product describes savings in their contract administration. Bizzkit reports less manual extraction work on legacy agreements. No law firm client billing workflow is identified in the current buyer materials, and those savings relate to the organization's own time and contracting costs.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Customer counsel can use the AI and data processing addenda to address a counterparty's AI clause. Conga's trust center names Google Cloud Vision for optical character recognition, Amazon Textract for table detection, Zuva for provision extraction and Azure OpenAI for language processing. It states a zero retention arrangement with each and explains what Azure OpenAI does and does not do with prompts and completions.
The subprocessor register identifies the supporting services. The Data Processing Addendum applies Clause 9(a) Option 2 of the Standard Contractual Clauses to that list, with fifteen days' notice, a right to object and termination with a refund. The Data Processing Addendum includes the standard contractual clauses and their UK and Swiss adaptations, alongside the separate Artificial Intelligence Addendum.
The processor register names Google Cloud for platform hosting and Azure for the language model, both in the EU, alongside supporting providers and their locations. Customer terms set a training consent requirement and confidentiality duties. The data processing agreement is generated through a workflow that requests customer details and acceptance of terms. No separate client consent pack or exact model version inventory accompanies the public processor register.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
The platform keeps a complete audit trail of every action, approval and signature across the contract lifecycle, which the vendor describes as supporting legal or internal reviews. It also keeps version control, tracked edits and inline comments. AiMe shows how every recommendation is generated and the reasoning behind AI driven actions, and confidence scores accompany each suggestion, so the basis of a proposed clause is visible at review.
No report or extract is described as identifying which model produced a passage, and the model is not named beyond a family. Conga describes no document level export, no marking of machine generated text against human edited text in a form a party could give a court, and no disclosure template, certification form or court guidance.
Imported agreements retain extracted fields, highlighted source passages and a verification state that users can inspect in the contract view. The application also tracks versions, collaboration and signature activity. These elements provide part of the record of a user's review, without a specified export connecting each AI response to its model version and a named human verifier. No court specific certification form or complete AI disclosure bundle is described.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
- Bar Guidance Alignment
Which one fits
Choose Conga CLM if
- Pricing and configuration from CPQ must flow into the contract.
- The organization needs a Salesforce native CLM option.
- Contract work should connect to Conga Composer and Conga Sign.
Choose Contractbook if
- Imported contract fields need source highlights and explicit verification.
- HubSpot deals are the starting point for contract creation.
- The team wants a contract workspace with defined plan allowances.
In summary
Conga CLM
Conga CLM sits within a broader commercial operations suite that connects quoting, contracting, document generation and signing. One edition runs on Salesforce; another uses the Conga Advantage Platform alongside other business systems. AiMe imports legacy and third party agreements, extracts provisions, compares drafts with playbooks and answers repository questions. The AI Legal Index identifies the connection from CPQ pricing, terms and configurations into contracts as a defining workflow difference. Authoring can take place in Word, Google Docs or the browser. AI processing uses several providers for language, optical character recognition, tables and provisions, with customer validation of recommendations required.
Contractbook
Contractbook focuses on a contract workspace for templates, collaborative approval, electronic signature and storage. Its AI Import produces structured fields from existing agreements, while the Contract Assistant handles questions, summaries and clause rewriting. The AI Legal Index highlights the source passages attached to imported values and the verification step before those values trigger automation. HubSpot deal data can populate drafts, with contract information returned after execution. Plans distinguish the number of users, templates and annual signed contracts. Initial imported files remain private until shared. Its terms require customer consent before customer data is used for AI training.
Questions buyers ask
Does Conga require Salesforce?
No. Conga offers both an application built on Salesforce and an edition on the Conga Advantage Platform. The latter connects with other CRM, ERP and procurement systems. The Salesforce option remains a distinct deployment choice. From the AI Legal Index, based on each vendor's own published materials as of October 15, 2026. No vendor pays for placement.
How does AI extraction differ?
Conga combines specialized services for optical character recognition, tables and provisions with language processing. Contractbook emphasizes extracted contract fields linked to source highlights and a verification step. Both turn existing agreements into structured information for later work. From the AI Legal Index, based on each vendor's own published materials as of October 15, 2026. No vendor pays for placement.
Where can users author contracts?
Conga supports Microsoft Word, Google Docs and a browser editor. Contractbook creates drafts from templates in its contract workspace and can populate them with HubSpot deal information. Both carry agreements onward through approval and signing. From the AI Legal Index, based on each vendor's own published materials as of October 15, 2026. No vendor pays for placement.
Are base subscription prices available?
Conga's current pricing flow requires a quote without a public starting amount. Contractbook's current plan cards also require a quote, though its company profile separately gives a starting rate of €89 per month. That figure is not a price for a Conga equivalent package. From the AI Legal Index, based on each vendor's own published materials as of October 15, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
This page compares two contract lifecycle products using their current workflows and terms. Claims about product performance remain vendor claims. The comparison was prepared without vendor review or hands on output testing. Scrive bought Contractbook in June 2025, and the service continues under the Contractbook name.