Conga CLM vs Contractzy: how they compare in 2026
Conga CLM makes the strongest functional case when contracting must connect closely to the commercial transaction. Its surrounding suite supplies quoting, contract generation, signature, and pricing capabilities, while CLM passes extracted agreement data into business processes. AiMe adds agreement questions, search, and redlining. Contractzy organizes the same broad lifecycle around a smaller set of named contract functions and CORA AI. A team can upload its risk guidebook, inspect highlighted revisions, and assign the resulting obligations without treating the wider revenue suite as the center of the project. Both support sales, procurement, and legal work, so department coverage alone does not separate them. Conga's distinguishing path connects contract activity with its broader commerce products and editing options. Contractzy's includes user and contract volume plans, task ownership, and cloud or customer premises deployment.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
AiMe is a shared AI layer across the commercial suite. It connects workflow data across CPQ, CLM, price optimization and document automation and suggests next steps, rather than being the CLM itself. Underneath sits a full contract lifecycle platform that long predates it, with template and clause library generation, approval routing, negotiation, electronic signature through Conga Sign, a searchable repository, obligation and renewal tracking, and reporting. The models drive core features on top of that platform. Without AiMe a working CLM remains, as the edition built on Salesforce was for years. Recent releases push AI further in. The June 2026 release extends AI across the platform, including bulk import and extraction for incoming contracts. The March 2026 AiMe release adds agents that act inside quoting and contracting workflows. Conga still sells and prices the platform as a contract system with intelligence on top.
CORA AI powers contract risk analysis, summarization, metadata extraction, and obligation management inside a broader contract lifecycle platform. Review starts with company guidebooks, while extraction turns scanned PDFs, images, and Word files into searchable information. Obligation management creates owners, milestones, deadlines, and renewal alerts from agreements. Templates, clause libraries, approvals, signatures, version history, and the repository remain useful without model inference. Essentials and Professional also separate conventional contracting functions from the fuller AI package in Enterprise. The models therefore run substantial review and analysis functions, while established workflow and storage features remain a separate part of the product.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
The AI pipeline divides document processing among specialized providers. Google Cloud Vision handles optical character recognition, Amazon Textract table detection, Zuva provision extraction and Azure OpenAI language processing. Output is grounded in the customer's own repository, playbook and clause library, and extraction needs no model training by the customer. AiMe shows how every recommendation is generated, with the reasoning visible and confidence scores wherever it makes a suggestion. The Artificial Intelligence Addendum addresses accuracy only through a disclaimer. It states that outputs may be inaccurate, incomplete or misleading and disclaims any warranty of accuracy or completeness. No accuracy figure, test set, error rate or benchmark result is available. Third party models undergo benchmarking before release, without disclosed results. The product cites no legal authority, so grounding in authority and citator checks do not apply.
Risk analysis highlights ambiguous clauses and departures from company guidebooks, then lets reviewers inspect changes through tracked redlines. CORA AI also extracts parties, dates, monetary terms, and obligations from uploaded agreements. Accuracy claims include 98% for risk detection, 95% or more for metadata extraction, and up to 99% in the pricing FAQ, without a defined evaluation set or error breakdown. The contract text supplies context, but a retrieval method with linked primary legal authority and citation treatment is unspecified. Severity labels describe contractual risk rather than confidence in an answer. Critical decisions still call for human review under the pricing guidance.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Conga states that AiMe never acts autonomously on high stakes decisions. Three mechanisms constrain it, agent guardrails, approval thresholds and human in the loop confirmation, and each can be built into a workflow. AiMe shows how every recommendation is generated and the reasoning behind AI driven actions. Confidence scores appear wherever it makes a suggestion, users accept or reject redlines, and every action and approval is kept in an audit trail. Much of the oversight model is written into the contract. The Artificial Intelligence Addendum makes the customer solely responsible for evaluating and validating outputs. It says the customer must not rely on AI outputs as the sole basis for any decision with legal, financial, regulatory or other material impact. It also requires human review and independent judgment, and puts authorizing and supervising agent actions on the customer. The guardrails and thresholds are described as configurable rather than as defaults, and the same document states that Conga does not monitor or review AI generated outputs.
Reviewers upload a Word or PDF guidebook or generate one with AI, scan an agreement, and inspect highlighted risks and tracked revisions. Editable guidebooks encode company requirements, and alerts identify departures or high risk clauses. Contracts failing mandatory criteria are prevented from advancing until compliance is ensured. Legal teams retain control over precise edits, with approval routing and version history supporting review before execution. The pricing guidance recommends human review for critical decisions. The remaining uncertainty is the control path after an incorrect classification: the criteria configuration, override permissions, and escalation route for an AI error are not specified.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Cotality, formerly CoreLogic, describes improving client service with Conga CLM in a September 2024 customer story without a quantified outcome. Two other dated stories, DigiKey on price management and Kalixia at 160 times faster document generation, concern other Conga products. Other named customers include Southwest Airlines, LinkedIn, AXA, Peloton, Cotality, T-Mobile, Adobe, Box and Kraft Heinz. The headline improvement figures are separate from those named customers. A 9 percent revenue increase appears beside the logo strip with no stated basis, and Conga claims 50 percent less review time with AI. Conga also cites G2 Leader recognition across five grids.
Legal leaders at Bajaj Markets, Bridgestone, and Easebuzz describe actual use of the platform. Manish Jain emphasizes responsive support; Reni Verghese describes managing contracts against timelines; Nitin Bhuwania describes reducing administrative effort and retrieving executed agreements after digitization. These accounts identify customers and concrete activities, although they do not supply dated before and after measurements. Separate CORA AI claims include an internal study of faster summarization and improved extraction, without a disclosed sample or method. Implementation generally takes two weeks to one month depending on integrations, customization, and migration. That estimate describes rollout effort rather than a measured customer outcome.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Under the Artificial Intelligence Addendum, Conga will not use AI Inputs or AI Outputs to train or improve any model beyond a limited license to provide, maintain or improve the Services for that customer. Customer Data will not train global or foundational models serving multiple customers, and no third party may use Customer Data or AI Output to train, fine tune, validate, test or develop any model. Tenants are logically separated with dedicated encryption keys. The Data Processing Addendum limits retention to the time absolutely necessary and requires return and deletion at the customer's election after the agreement ends. Prompts, completions, embeddings and training data sent to Azure OpenAI are not available to OpenAI and are not used to improve OpenAI, Microsoft or third party products. Each document processing provider works under a zero retention arrangement. Conga sells the product to legal departments to hold their agreements, and its addenda, trust center and product pages do not address attorney client privilege or work product. Separate contractual conditions sit in Conga's Master Services Agreement.
The agreement limits personal data use to delivering, maintaining, securing, and improving the contracted services under customer instructions. It covers contract files, attachments, metadata, communications, approval records, and access logs, and rules out selling customer data or unrelated advertising uses. Subprocessors must accept protections at least as strong as the agreement. Role permissions restrict visibility to authorized departments and users, while production access follows least privilege. The improvement permission contains no explicit model training exclusion. Privilege preservation, work product treatment, matter isolation during retrieval, and foundation model retention commitments remain unspecified, so these provisions do not settle every confidentiality question for a law firm.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Conga's position on advice versus tooling sits in the Artificial Intelligence Addendum. The Addendum states that AI generated outputs may be inaccurate, incomplete or misleading, disclaims any warranty of fitness, and makes the customer solely responsible for validating outputs before use. It says the customer must not rely on AI outputs as the sole basis for any decision with legal, financial, regulatory or other material impact, and that human review and independent judgment should be exercised. It applies the same rule to agents, making the customer responsible for deciding whether agent actions are appropriate and for authorizing and supervising them. Legal, sales and procurement teams use the application as a contracting tool. The service does not specify how a supervising lawyer meets competence or oversight duties over AI drafted contract language. Capability restrictions by buyer group and jurisdictional limits are not specified. The product is marketed to sales and procurement users who generate contract positions in the same tenant as legal.
Legal departments use CORA AI to identify contractual risks, make edits, and manage approvals, while procurement, sales, finance, and HR users share the broader workflow. Human decision authority is explicit in the product positioning, and critical decisions are subject to a recommendation for human review. The CORA AI introduction also directs customers to consult their legal departments about regulatory implementation. Those operating instructions do not establish an advice versus software boundary, permitted legal jurisdictions, or a position on unauthorized practice. The software terms disclaim warranties generally without a specific legal advice disclosure. Nonlawyer participation is supported without a corresponding professional responsibility framework.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Conga's AI governance framework sits in the Artificial Intelligence Addendum rather than on a principles page. The Addendum records a cross functional AI Governance Committee responsible for oversight of AI within the Services. The committee focuses on risk management, accountability and compliance, and periodically reviews AI risks, controls and mitigations. Conga commits to internal policies on responsible AI covering oversight of training data, bias mitigation and human interpretability, to staff training, and to full cooperation with a customer's own AI impact assessments. Governance is tied to the NIST AI Risk Management Framework and its four functions, Govern, Map, Measure and Manage. The vendor classifies its products as minimal or limited risk AI systems under the EU AI Act. It states that third party models are tested, audited for bias and benchmarked before release, with rollback to any prior model version within hours. Results from that testing, bias audit findings, evaluation outputs and model cards are not available, including performance differences across contract types.
The CORA AI introduction describes pretrained language models refined through legal expert feedback, regular updates, and testing across legal scenarios. That establishes a quality aspiration but leaves release criteria, review ownership, evaluation sets, and results across contract types or jurisdictions unspecified. The model training description refers broadly to contracts, legal materials, and precedents rather than a traceable evaluation program. Prajot Borkar is the named data protection officer, responsible for privacy compliance; that role does not establish accountability for model behavior. Company guidebooks let customers impose their own contract policies, but they are distinct from governance of the vendor's models and training process.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The Data Processing Addendum says retention of personal data should generally not be required and is limited to the time absolutely necessary to perform the Services. Daily backups are kept for thirty days, and each third party document processing provider works under a stated zero retention arrangement. Data is returned or deleted at the customer's election within a reasonable period after the agreement ends, and the CCPA attachment requires prompt compliance with deletion requests. Access controls include role based authorization, least privilege, quarterly access reviews, multifactor authentication, encryption at rest, TLS of 256 bits or stronger in transit, and per tenant encryption keys. The subprocessor terms provide fifteen days' notice before additions, a right to object with termination and refund, and Conga's responsibility for provider acts. Incident notice comes within 48 hours of Conga becoming aware, backed by a response plan with root cause analysis and a 24/7 security team.
The May 2026 agreement identifies eight subprocessors and their functions, including AWS for hosting, Bedrock inference, and Textract processing. Controls include encryption, least privilege access, internal multifactor authentication, audit logs, restricted production access, monitoring, and backups. Incident procedures cover identification, investigation, management, and response. Customer notification follows a confirmed personal data breach without undue delay where legally required, rather than an unconditional fixed deadline. Data remains as long as needed for service, legal, dispute, or security purposes. Return or deletion follows a written request at termination within a commercially reasonable timeframe, with unspecified backup schedules and legal exceptions.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The Artificial Intelligence Addendum states that Conga makes no warranty, express or implied, on the accuracy, completeness, noninfringement or fitness for purpose of AI generated output. The customer is solely responsible for evaluating and validating that output. To the maximum extent permitted by law, Conga is not liable for any losses, damages or claims arising from the customer's use of or reliance on AI output or on actions by agentic AI features. That includes third party claims. One allocation runs the other way. The Data Processing Addendum makes Conga liable for its subprocessors' acts and omissions as if it had performed the services itself, and much of the AI pipeline sits with those third parties. The addenda do not state a general liability cap, an indemnity scope or an insurance position. Conga's Master Services Agreement is a separate document.
The software terms cap the operator's and suppliers' liability at the amount the client actually paid. Service comes as is and as available, with broad exclusions for warranties, fitness, noninfringement, accuracy of performance, and correction of errors. The agreement does not attach an indemnity, insurance commitment, or enforceable accuracy warranty to CORA AI output. It also excludes responsibility for incomplete or corrupt backups and places independent backup responsibility on the client. India is the defined country for governing law, with informal dispute resolution first. These terms allocate general software risk without promising a remedy for an incorrect contractual recommendation.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Several of Conga CLM's integrations are structural. One edition runs natively on Salesforce and is listed on the Salesforce AppExchange. Authoring and review run inside Microsoft Word and Google Docs, and Microsoft Dynamics is named on the product page. The platform edition supports connections to CRM, ERP and procurement systems. Within Conga's own products, pricing, terms and configurations flow from CPQ into a contract. Documents are generated through Composer and signed through Conga Sign, and price optimization feeds contract pricing. Developer resources cover APIs and integrations. Field mapping and sync directions for individual external connectors are not specified alongside the broader connections.
Salesforce users can create, approve, and sign contracts within their CRM, while HubSpot data can generate agreements and feed approval and signature steps. Oracle supports contract creation and management, and Jira tickets initiate creation and approvals. Slack brings contract updates and actions into team conversations; Gmail supports workflows from the inbox. DocuSign, Adobe Sign, and UAE Pass provide signature connections, with Zoho also supporting contract generation and tracking. Custom APIs and integrations are available. Field mappings, authentication setup, synchronization conflicts, and permission propagation are not described, so the connection list does not establish a complete implementation specification for each workflow.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The CLM has two delivery forms. One is the original application built on Salesforce. The other is a software as a service edition on the Conga Advantage Platform that gives buyers a CLM interface independent of Salesforce. The Data Processing Addendum treats them differently. It states that Conga does not back up customer data for services hosted on Salesforce and sets no recovery point objective for them. Elsewhere it keeps daily backups for thirty days, with a one hour recovery point objective and a twenty four hour recovery time objective. Infrastructure is named as Salesforce, Amazon Web Services and Azure, with data on servers managed by Salesforce and AWS. Each logical tenant boundary has its own encryption key. Availability is described as spanning the United States, the European Union and Asia Pacific with residency options included, which names continents rather than regions. A region list, the method of choosing a tenant's region and separate processing locations are not specified. Content reaches Azure OpenAI, Google Cloud Vision, Amazon Textract and Zuva, and the processing locations are not specified.
AWS cloud hosting is the standard delivery route, with an additional single tenant cloud option and deployment on customer premises. Implementation scope depends on integrations, migration, and customization, and Enterprise includes custom integration and deployment options. The agreement identifies AWS operations as global, including India, Singapore, and the United States, while other processors operate in additional global locations. Cross-border safeguards may include applicable standard contractual clauses. These locations describe the processor network rather than selectable customer residency regions. The division between contract storage, model inference, OCR processing, and backup locations is not specified for each deployment option or subscription tier.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
SOC 2 Type II covers the full platform under annual audits, according to Conga. The trust center also lists ISO 27001, ISO 27701 as its privacy extension, PCI DSS, HIPAA Security with annual audits, GDPR and CCPA. It adds alignment to the NIST AI Risk Management Framework and certification under the EU-U.S. Data Privacy Framework. The Data Processing Addendum links that certification to the Department of Commerce register. The security program includes annual third party penetration testing, application vulnerability assessment twice a year, continuous automated threat hunting and code analysis before release. It also covers a patching service level by severity, background checks, annual security training and a vulnerability disclosure program. Auditor names, report periods, observation windows and certificate numbers are not available alongside those claims, and reports require a request. The Data Processing Addendum makes reports available on a customer's request under confidentiality, so a prospective buyer cannot read the audit scope before signing.
The company identifies itself as ISO 27001:2022 certified and describes encryption, AWS hosting, role permissions, and restricted production access. Its agreement adds TLS 1.2 or later, internal multifactor authentication, continuous monitoring, security alerts, and backup and recovery measures. On a reasonable written request, the company may provide existing compliance material, certifications, or third-party audit reports instead of a disruptive audit. A current certificate scope, validity period, and directly accessible report are not supplied with these statements. Generic security language and a badge do not establish the scope of a separate SOC 2 examination or an AI-specific assurance program.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Generative features run on Microsoft Azure OpenAI. The document processing agents also use Google Cloud Vision for optical character recognition, Amazon Textract for table detection and Zuva for provision extraction, each under a stated zero retention arrangement. The Azure OpenAI Service is described as fully controlled by Microsoft, hosted in Microsoft's own Azure environment and not interacting with any system operated by OpenAI. Prompts, completions, embeddings and training data are tokenized in transit, are not available to OpenAI, and are not used to improve OpenAI, Microsoft or third party models. Change notice is contractual. The AI providers are subprocessors, and the Data Processing Addendum gives fifteen days' notice before a new one is appointed, with its name, location and activity. It also gives a right to object, and termination with a refund if no workaround exists. No specific model is named. The Addendum refers to Azure OpenAI GPT, which is a family rather than a version, and nothing states which model writes a summary or a redline or when that changes.
Amazon Bedrock supplies AI and machine learning processing, and Amazon Textract handles OCR and document processing within the AWS subprocessor role. CORA AI uses an array of pretrained language models and a training process involving legal contracts, materials, precedents, and expert feedback. This identifies infrastructure and broad architecture, while leaving the foundation model families, versions, routing rules, and fine-tuning arrangements unnamed. Subprocessors may change as technical or operational needs evolve. The agreement does not commit to advance model change notices or identify which model handles a particular risk review, summary, or obligation extraction. Provider locations likewise do not assign inference to a particular region.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Conga CLM uses custom quotes without a numeric starting rate, a defined billing unit or a plan table. The application combines drafting, negotiation, approvals, electronic signature, contract storage and obligation management, with AI review and extraction inside that workflow. Additional products connect CPQ, document generation and signing to the wider suite. An advanced CLM feature set includes clause libraries, version control and redlining, but its incremental charge is not specified. Subscription duration, renewal provisions, price increase limits and implementation fees are not given with the quote request. The Master Services Agreement is separate from the AI and data processing addenda.
Essentials supports up to three users and 50 contracts each month; Professional allows up to ten users and 200 contracts; Enterprise starts above ten users with 500 monthly contracts. Each base subscription requires a quote. The pricing matrix lists Professional AI risk analysis at $40 per user per month, with up to 100 analyses monthly, while Enterprise includes 20 free reviews. Unlimited storage and distinct signature allowances accompany the plans. Reviewers need no additional license. Integrations, customization, migration, and deployment affect implementation scope, but their charges are not stated. The AI add-on figure therefore does not represent the total cost of running the platform.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Legal, procurement, sales, finance, IT, business operations and pricing teams use the suite. Their CLM tasks differ. Legal gets workflow, authoring, AI review and redlining, compliance and risk management. Procurement gets obligation management, AI extracted terms and pricing. Sales gets generation, AI assisted negotiation and renewals. Industry uses cover technology, financial services, healthcare, life sciences, manufacturing, transport and logistics, and distribution. Named customers span airlines, insurance, media, retail and property data. No practice area inside a legal department is named as supported or unsupported, and nothing states what the product is not for. Capability restrictions for users who are not lawyers are not specified inside a shared tenant. Jurisdiction and language coverage boundaries are also unspecified, although the product is localized into German and French.
The primary audience is corporate legal operations alongside procurement, finance, sales, HR, compliance, and operational teams. Legal workflows include drafting, negotiation, risk review, approval, execution, repository retrieval, and ongoing obligations. Sector offerings include fintech, automotive, manufacturing, healthcare, software, real estate, logistics, and other commercial industries. Templates and guidebooks adapt review to company policies, while repository filters include jurisdiction, expiry, and contract value. Regional offerings span Europe, the Americas, Asia, and the Middle East, but a jurisdiction and language support matrix is unspecified. Litigation research, court filing, and consumer legal representation are not established parts of the contracting service.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The Artificial Intelligence Addendum expressly permits training on customer content, within written limits. Section (c) says Conga will not use Customer Data to train global or foundational models that serve multiple customers. Any training on Customer Data is limited to models specific to the customer's instance or tenant. Permitted training is limited to the customer's own data and a model only that customer uses, and neither the Addendum nor the trust center describes an opt out.
Conga does not use Customer Data to train third party foundational models, naming Azure OpenAI GPT as the example. Section (d) says Conga will not let any third party use Customer Data or AI Output to train, fine tune, validate, test or otherwise develop any AI model. Section (b) says that, beyond a limited license to provide, maintain or improve the Services for that customer, Conga will not use AI Inputs or AI Outputs to train or improve any model.
The trust center adds that models trained on one customer's data are never used for another. One carve out is reserved. Service Attributes, defined as anonymized and aggregated usage information, may be used to train and refine models and are stated not to be Customer Data.
The DPA allows personal data use for providing, maintaining, securing, and improving the services, subject to customer instructions. Contract files, attachments, and related workflow records fall within that processing scope. The improvement right has no explicit model training exclusion, while advertising profiling and unrelated commercial uses are prohibited. This is a contractual permission for improvement, not a statement that customer contracts actually train CORA AI.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
The Data Processing Addendum lets the customer control retention by contractual instruction. Attachment A sets the default. Retention of personal data should generally not be required, and any retention is limited to the time absolutely necessary to perform the Services. Section 9.6 requires return and deletion at the customer's election within a reasonable period after the agreement ends, with the customer deleting within the Services and Conga helping where it cannot.
The CCPA attachment adds a duty to follow any customer deletion instruction promptly. Daily backups are kept for thirty days, except for services hosted on Salesforce, which Conga does not back up. At the model layer, Conga states a zero retention policy with each third party document processing provider. Documents sent to Azure OpenAI, Google Cloud Vision, Amazon Textract and Zuva are therefore processed in real time and not stored. No zero retention setting is offered to the customer inside the Services.
Personal data remains for as long as needed to operate the service, meet legal obligations, resolve disputes, and enforce agreements. Written requests at termination can trigger return or deletion within a commercially reasonable timeframe. Backup copies persist under unspecified schedules, with legal, security, and audit exceptions. No routine duration is assigned specifically to prompts, generated summaries, or review outputs while the subscription remains active.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Conga CLM has its own permission model, which the customer administers. Between customers, separation is built into the architecture. Tenant environments are logically separated, each with its own encryption keys, and models trained on one customer's data are never used for another customer's recommendations or scores. Inside a tenant, the Data Processing Addendum's security attachment requires role based authorization, least privilege, quarterly access reviews, multifactor authentication and the customer's ability to limit access to authorized personnel.
Rules based access controls, audit logs and admin tools help the customer configure and manage AiMe, which leaves the alignment work with the customer. The product does not apply an outside document management system's access model at query time. The addenda and trust center do not address segregation between matters or business units inside one tenant. The platform is sold to legal, procurement, sales, finance and IT in the same instance, and the assistant answers questions across the whole contract repository.
Department and user permissions limit visibility into contract status, approvals, obligations, and renewals. The DPA also specifies role permissions, least privilege, and restricted production access. Neither provision explains how CORA AI retrieval enforces a law firm's matter walls or inherits permissions from an external document system. Single tenant deployment separates organizations, but does not by itself establish boundaries between conflicting matters inside one organization.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 4 of the Data Processing Addendum's security attachment is headed Disclosure by Law. If Conga is required by law to disclose customer data, it will notify the customer as soon as practical where the law permits. It will also take all steps to give the customer an opportunity to prevent or limit the disclosure, an obligation to help and not only to inform. The CCPA attachment adds a slightly stronger commitment for personal information.
For a legally required disclosure unrelated to the contracted business purpose, Conga must first tell the customer and give it a chance to object or challenge the requirement, unless the law prohibits notice. Conga will also redirect a misdirected data subject request to the customer and will not respond without the customer's prior written consent unless legally required. No transparency report, aggregate demand count or reporting cadence is available.
The DPA requires prompt notice when a data subject requests access, correction, deletion, or another personal data right. That obligation concerns individuals exercising privacy rights, not subpoenas or government demands for customer contracts. The software terms and privacy provisions do not establish a separate commitment to tell customers before responding to compulsory legal process. Breach notifications are also a different event and do not settle this question.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Conga CLM works from the customer's own material. That means contracts imported in bulk, including third party, legacy and acquired agreements, plus the customer's clause library, negotiation playbook and approved templates. The vendor states that precise models are built from the customer's own documents without the customer having to train them. The generative layer is named too. Azure OpenAI handles language processing, with Google Cloud Vision, Amazon Textract and Zuva for optical character recognition, table detection and provision extraction.
Conga states no rights basis for any of these sources and does not describe what the underlying foundation models were trained on. Zuva's extraction models are trained on contract collections rather than on the customer's documents, and they are named without any account of what sits behind them. On the customer's side, the Artificial Intelligence Addendum leaves the customer with all right, title and interest in its AI Inputs and AI Outputs and grants Conga only a limited license.
Risk review uses customer guidebooks uploaded in Word or PDF, company playbooks, and the contract being analyzed. CORA AI's training description also refers to broad datasets of legal contracts, materials, and precedents. It does not identify a primary law collection, its licensing basis, or an update schedule for individual sources. A company policy guidebook supplies contractual positions, but does not establish the origin or currency of legal authorities.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
The product cites no cases, statutes or regulations, so checking authority for later history does not arise in its usual form. It works on the customer's own agreements, comparing drafts to a negotiation playbook, matching against an approved clause library, extracting obligations and dates, summarizing, and answering questions about the repository. Nothing it produces is a statement about the law that a lawyer would check for later treatment.
The nearest point is obligation and renewal tracking, where the question is whether a contractual date or duty is still live, and alerts and dashboards handle that. No feature checks legal authority for subsequent history.
CORA AI scans agreements for risky clauses and deviations from a company's guidebook, then presents severity labels and suggested revisions. No case treatment indicator or connection to a named legal citator accompanies that review workflow. Regular legal updates are a general training claim rather than a check on an authority's subsequent history. The human review recommendation concerns critical decisions and does not describe automatic verification that cited law remains valid.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Conga commits that AiMe shows how every recommendation is generated, that users see the reasoning behind AI driven actions, and that confidence scores appear wherever AiMe makes a suggestion. That gives a reviewer a signal for each suggestion. Conga does not describe what the system does when it cannot ground an answer. An explicit refusal response or unsupported extraction marker is not specified. Nor does it say what happens when a clause cannot be matched to the playbook or a question cannot be answered from the repository.
No evaluation results for that behavior are available. The Artificial Intelligence Addendum allocates the consequences instead. It says outputs may be inaccurate, incomplete or misleading, makes the customer solely responsible for validating them, and states that Conga does not monitor or review AI generated outputs. The precise behavior of the guardrails is not specified.
Critical, high, medium, and low labels prioritize the contractual significance of a detected issue. They do not measure the model's confidence or describe what happens when an answer lacks support. Mandatory compliance criteria can stop a contract from advancing, but that workflow restriction is separate from an AI refusal to answer. The risk and summary workflows do not specify an unsupported-answer response or a grounding threshold shown to reviewers.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin tracks decisions worldwide where a court addressed hallucinated AI content, and records the tool implicated where known. It records no court order, opinion or disciplinary record naming Conga CLM or Conga. Two independent sanctions trackers of decisions on AI generated fabricated citations do not name them either. Conga CLM works on contracts and cites no legal authority, so its output does not ordinarily reach a court filing.
No court finding involving Contractzy, CORA AI, or The Legal Capsule appears in the AI Hallucination Cases database as of October 15, 2026. The current name and former brand produced no relevant match across its 2,191 entries. This dated result concerns reported proceedings. It does not establish that generated clauses or legal assertions are accurate, or rule out a proceeding outside that collection.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No bar or ethics guidance is named for the service. ABA Formal Opinion 512 does not appear, no state guidance on generative AI in legal practice is referenced, and nothing maps a capability to a jurisdiction's rules of professional conduct. Conga does cite outside frameworks, but none of them is professional responsibility guidance. The Artificial Intelligence Addendum ties governance to the NIST AI Risk Management Framework, and the trust center classifies the products as minimal or limited risk AI systems under the EU AI Act.
Both are addressed to the vendor as an AI provider. The nearest thing to a professional responsibility statement is the Addendum's requirement that the customer not rely on AI outputs as the sole basis for a decision with legal impact. It also requires the customer to exercise independent judgment. It names no guidance.
The CORA AI introduction encourages customers to involve their legal departments when aligning implementation with regulatory requirements. Product guidance also recommends human review for critical decisions. These directions do not engage with a named bar opinion, client consent standard, or professional competence rule. The intended corporate legal audience and collaboration with nonlawyer departments are clear, while a jurisdiction-specific ethics mapping for use of AI in legal work remains unspecified.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product serves corporate teams managing their own commercial agreements. The named audiences are in house functions, legal, procurement, sales, finance, IT and business operations, each with its own page. The named customers are corporate, among them an airline, an insurer, a property data business, a consumer fitness company and a professional network. Nothing is addressed to a law firm billing a client. Conga's efficiency claims include a 9 percent revenue increase, 50 percent less review time with AI, faster deal cycles and lower supplier costs.
All of them concern the buyer's own cost, cycle time or revenue, and none reaches a client bill. The platform also runs quoting, pricing and billing, but that is the customer billing its own customers rather than a lawyer billing a client. No client fee disclosure workflow for AI assistance is specified.
CORA AI is positioned for corporate departments managing their employer's contracts, alongside procurement, sales, finance, and HR. Faster review, metadata extraction, and obligation tracking reduce those teams' own administrative costs. That workflow does not ordinarily create a bill from outside counsel to a client. Subscription charges and AI add-on units price the software, while no client time-entry adjustment or legal fee disclosure feature is described for the core corporate use case.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Customer counsel can use the AI and data processing addenda to address a counterparty's AI clause. Conga's trust center names Google Cloud Vision for optical character recognition, Amazon Textract for table detection, Zuva for provision extraction and Azure OpenAI for language processing. It states a zero retention arrangement with each and explains what Azure OpenAI does and does not do with prompts and completions.
The subprocessor register identifies the supporting services. The Data Processing Addendum applies Clause 9(a) Option 2 of the Standard Contractual Clauses to that list, with fifteen days' notice, a right to object and termination with a refund. The Data Processing Addendum includes the standard contractual clauses and their UK and Swiss adaptations, alongside the separate Artificial Intelligence Addendum.
The DPA names AWS, Razorpay, DocuSign, Zoho Sign, emSigner, Digio, OnlyOffice, and Mailgun with locations and purposes. AWS includes Amazon Bedrock for AI processing and Textract for OCR, giving procurement teams a concrete starting point for provider disclosure. Foundation model versions and a client consent package are unspecified. Subprocessors may change with operational needs, without a separate advance-notification period or customer objection process in the listed terms.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
The platform keeps a complete audit trail of every action, approval and signature across the contract lifecycle, which the vendor describes as supporting legal or internal reviews. It also keeps version control, tracked edits and inline comments. AiMe shows how every recommendation is generated and the reasoning behind AI driven actions, and confidence scores accompany each suggestion, so the basis of a proposed clause is visible at review.
No report or extract is described as identifying which model produced a passage, and the model is not named beyond a family. Conga describes no document level export, no marking of machine generated text against human edited text in a form a party could give a court, and no disclosure template, certification form or court guidance.
Tracked revisions, version history, contract audit trails, and approval records preserve parts of the drafting and review process. Legal teams can see changes and updates as agreements move through the lifecycle. Those records do not establish a per-contract export identifying the model, retrieved sources, and a human's verification of each AI result. The platform addresses commercial contract execution; a court filing disclosure or certification workflow is not specified.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
- Bar Guidance Alignment
Which one fits
Choose Conga CLM if
- Contract generation needs to use pricing and configurations from Conga CPQ.
- Your authors split their work between Microsoft Word and Google Docs.
- The project includes a broader set of commerce capabilities alongside the CLM repository.
Choose Contractzy if
- A central contract team wants guidebook review and obligation assignment within one lifecycle workspace.
- Your package needs explicit user and monthly agreement allowances.
- Hosting the contract application on your own premises is a required option.
In summary
Conga CLM
Conga CLM combines authoring, negotiation, obligation tracking, and a central agreement repository. It supports work in Microsoft Word and Google Docs and connects contract data to CRM, ERP, and procurement systems. Its link from approved quotes into agreements is a commercial workflow distinction highlighted by the AI Legal Index. AiMe provides separate skills for agreement questions, redlining, and natural language repository search. Conga Composer, Sign, and CPQ can extend that process, but they are distinct products within the surrounding suite.
Contractzy
Contractzy uses CORA AI to extract terms, summarize agreements, review risk, and organize obligations after signature. The AI Legal Index identifies its combination of editable guidebooks and tracked revisions as the center of the review workflow. Business users can create contracts from connected systems, with approvals and signature in the same process. Plans combine named user limits with monthly contract volumes, while API access and system connections vary by package. Customer premises installation is available alongside hosted delivery.
Questions buyers ask
How does Conga's CLM relate to its quoting products?
Conga can carry pricing, terms, and configurations from CPQ into agreements. CLM then handles the contract process, while Composer and Sign support generation and signature within the broader suite. From the AI Legal Index, based on each vendor's own published materials as of October 15, 2026. No vendor pays for placement.
Do both products support contract questions and summaries?
Conga AiMe includes agreement questions and repository search skills. Contractzy's summary function extracts clauses, obligations, deadlines, and financial terms into a structured overview shared across teams. From the AI Legal Index, based on each vendor's own published materials as of October 15, 2026. No vendor pays for placement.
Can a Contractzy workflow begin inside a sales system?
Yes. Its Salesforce connection supports creating, approving, and signing agreements, and its HubSpot connection uses CRM data to generate contracts. Available integration access depends on the selected package. From the AI Legal Index, based on each vendor's own published materials as of October 15, 2026. No vendor pays for placement.
Does buying Conga CLM automatically include every commerce product?
The CLM product is part of a broader family that includes CPQ, Composer, and Sign. Those product relationships do not establish that every function is included in one subscription or at one price. From the AI Legal Index, based on each vendor's own published materials as of October 15, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Conga CLM is a product of Conga Corporation. Contractzy's operator is Attort Legal Consultancy Private Limited. References to the Conga commerce suite distinguish adjacent products from the contract management functions compared here.