Conga CLM vs netLex: how they compare in 2026
Conga CLM suits organizations connecting contracting to a wider commercial operations suite, especially where Salesforce or the Conga Advantage Platform already anchors the process. netLex is a focused alternative for company legal teams coordinating contracts, legal requests and powers of attorney with sales and procurement. Both have AI review within conventional lifecycle workflows, so a demo should follow a real contract from intake through approval. Their training positions differ in a specific way: Conga permits models built for the individual customer while restricting broader training, whereas netLex's privacy policy prohibits model training with AI inputs. In this comparison, AI Legal Index treats that permission difference separately from either vendor's encryption claims. netLex also explains its user based charging structure and included document automation, while Conga's suite and deployment choices make the scope of the selected package especially consequential.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
AiMe is a shared AI layer across the commercial suite. It connects workflow data across CPQ, CLM, price optimization and document automation and suggests next steps, rather than being the CLM itself. Underneath sits a full contract lifecycle platform that long predates it, with template and clause library generation, approval routing, negotiation, electronic signature through Conga Sign, a searchable repository, obligation and renewal tracking, and reporting. The models drive core features on top of that platform. Without AiMe a working CLM remains, as the edition built on Salesforce was for years. Recent releases push AI further in. The June 2026 release extends AI across the platform, including bulk import and extraction for incoming contracts. The March 2026 AiMe release adds agents that act inside quoting and contracting workflows. Conga still sells and prices the platform as a contract system with intelligence on top.
netLex combines a contract lifecycle platform with AI for clause drafting, review, extraction and questions about agreements. Its OpenAI integration lets users simplify, translate or revise clauses with prepared or custom prompts. Review Agent compares incoming contracts with the customer's playbook, while Creation Agent turns an existing document into questionnaire fields and variables. Management Agent extracts dates, parties, amounts and obligations for portfolio monitoring. Those capabilities sit within a wider system of templates, approvals, negotiation, signatures and storage that can operate without generation. The June 2026 agent announcement also describes an early access program; creating templates from a description alone was still forthcoming.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
The AI pipeline divides document processing among specialized providers. Google Cloud Vision handles optical character recognition, Amazon Textract table detection, Zuva provision extraction and Azure OpenAI language processing. Output is grounded in the customer's own repository, playbook and clause library, and extraction needs no model training by the customer. AiMe shows how every recommendation is generated, with the reasoning visible and confidence scores wherever it makes a suggestion. The Artificial Intelligence Addendum addresses accuracy only through a disclaimer. It states that outputs may be inaccurate, incomplete or misleading and disclaims any warranty of accuracy or completeness. No accuracy figure, test set, error rate or benchmark result is available. Third party models undergo benchmarking before release, without disclosed results. The product cites no legal authority, so grounding in authority and citator checks do not apply.
Review Agent compares clauses with a company playbook and explains departures from its standards. netLex also describes questions about contracts and attachments, including inconsistencies between the main agreement and a commercial appendix. These are useful sources of context, but the product materials do not demonstrate an openable citation for each answer or a method for validating cited legal authorities. No reproducible accuracy test, sample size or breakdown of missed risks is published. The terms explicitly warn that AI responses may be inaccurate, incomplete or unsuitable. A reviewer therefore has to compare proposed changes with the agreement and applicable law before relying on them.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Conga states that AiMe never acts autonomously on high stakes decisions. Three mechanisms constrain it, agent guardrails, approval thresholds and human in the loop confirmation, and each can be built into a workflow. AiMe shows how every recommendation is generated and the reasoning behind AI driven actions. Confidence scores appear wherever it makes a suggestion, users accept or reject redlines, and every action and approval is kept in an audit trail. Much of the oversight model is written into the contract. The Artificial Intelligence Addendum makes the customer solely responsible for evaluating and validating outputs. It says the customer must not rely on AI outputs as the sole basis for any decision with legal, financial, regulatory or other material impact. It also requires human review and independent judgment, and puts authorizing and supervising agent actions on the customer. The guardrails and thresholds are described as configurable rather than as defaults, and the same document states that Conga does not monitor or review AI generated outputs.
Administrators must enable the OpenAI functionality before users can access it, and customer policies govern its use. A reviewer can accept, edit or reject suggested wording, with the final contract remaining under human control. netLex describes additional approval steps for important negotiation changes and a Review Agent configured against the customer's clause rules and acceptable limits. Its July 2026 explanation distinguishes automated actions from human decisions in the history. The precise uncertainty level that stops an agent, mandatory escalation triggers and the procedure for undoing an erroneous downstream action are not published. The terms require users to assess AI results before adopting them.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Cotality, formerly CoreLogic, describes improving client service with Conga CLM in a September 2024 customer story without a quantified outcome. Two other dated stories, DigiKey on price management and Kalixia at 160 times faster document generation, concern other Conga products. Other named customers include Southwest Airlines, LinkedIn, AXA, Peloton, Cotality, T-Mobile, Adobe, Box and Kraft Heinz. The headline improvement figures are separate from those named customers. A 9 percent revenue increase appears beside the logo strip with no stated basis, and Conga claims 50 percent less review time with AI. Conga also cites G2 Leader recognition across five grids.
Gupy provides a named example of deployment with operational figures. In netLex's September 2026 account, Gupy simplified its commercial amendment language, introduced defined approval responsibilities and connected Salesforce before measuring changes in the first months. Average amendment completion fell from 38 to 25 days, while legal response time fell from 1.58 to 0.31 day. Amendments signed without customer changes increased from 16% to 60%. The account attributes the improvements to a combined process and integration project, not an isolated AI intervention. Exact observation dates, document counts and an independently reviewed measurement protocol are absent, limiting comparisons with other organizations.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Under the Artificial Intelligence Addendum, Conga will not use AI Inputs or AI Outputs to train or improve any model beyond a limited license to provide, maintain or improve the Services for that customer. Customer Data will not train global or foundational models serving multiple customers, and no third party may use Customer Data or AI Output to train, fine tune, validate, test or develop any model. Tenants are logically separated with dedicated encryption keys. The Data Processing Addendum limits retention to the time absolutely necessary and requires return and deletion at the customer's election after the agreement ends. Prompts, completions, embeddings and training data sent to Azure OpenAI are not available to OpenAI and are not used to improve OpenAI, Microsoft or third party products. Each document processing provider works under a zero retention arrangement. Conga sells the product to legal departments to hold their agreements, and its addenda, trust center and product pages do not address attorney client privilege or work product. Separate contractual conditions sit in Conga's Master Services Agreement.
The privacy policy states that inputs supplied to netLex AI will not train the model, and the product description says drafting and review data are not retained by the AI service. Access controls use roles, corporate authentication and customer permissions. netLex describes agents as unable to reach information beyond the current user's access, with a separate customer environment. Contract storage nevertheless has its own lifecycle: deleted user records can leave name and email history, and backups remain for five years. The public terms do not directly promise preservation of attorney privilege or explain how model provider access affects work product protection.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Conga's position on advice versus tooling sits in the Artificial Intelligence Addendum. The Addendum states that AI generated outputs may be inaccurate, incomplete or misleading, disclaims any warranty of fitness, and makes the customer solely responsible for validating outputs before use. It says the customer must not rely on AI outputs as the sole basis for any decision with legal, financial, regulatory or other material impact, and that human review and independent judgment should be exercised. It applies the same rule to agents, making the customer responsible for deciding whether agent actions are appropriate and for authorizing and supervising them. Legal, sales and procurement teams use the application as a contracting tool. The service does not specify how a supervising lawyer meets competence or oversight duties over AI drafted contract language. Capability restrictions by buyer group and jurisdictional limits are not specified. The product is marketed to sales and procurement users who generate contract positions in the same tenant as legal.
netLex is aimed at legal departments and the business teams working with them on company agreements. Its terms require users to assess the relevance, accuracy and suitability of AI results before adopting them for any purpose. They also state that AI cannot replace necessary human, legal, technical or professional analysis. The drafting interface supports this division by leaving acceptance or rejection of suggestions with the user. However, jurisdictional limits on automated legal opinions and a detailed account of lawyers' competence or supervision duties are not supplied. Corporate staff can initiate contracts and requests without being lawyers, making the configured approval route significant.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Conga's AI governance framework sits in the Artificial Intelligence Addendum rather than on a principles page. The Addendum records a cross functional AI Governance Committee responsible for oversight of AI within the Services. The committee focuses on risk management, accountability and compliance, and periodically reviews AI risks, controls and mitigations. Conga commits to internal policies on responsible AI covering oversight of training data, bias mitigation and human interpretability, to staff training, and to full cooperation with a customer's own AI impact assessments. Governance is tied to the NIST AI Risk Management Framework and its four functions, Govern, Map, Measure and Manage. The vendor classifies its products as minimal or limited risk AI systems under the EU AI Act. It states that third party models are tested, audited for bias and benchmarked before release, with rollback to any prior model version within hours. Results from that testing, bias audit findings, evaluation outputs and model cards are not available, including performance differences across contract types.
netLex publishes principles for AI use in contracts: company playbooks, access permissions, traceable decisions and final human approval. It describes logs that distinguish automated decisions from human actions and presents these controls as part of its own design. That establishes an AI governance position, but not a full account of how the vendor tests its models. No named owner for model risk, release evaluation protocol, bias assessment across languages or results across contract types are supplied. The Information Security and Compliance Committee oversees security and privacy; its existence alone does not show accountability for uneven legal output or model behavior.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The Data Processing Addendum says retention of personal data should generally not be required and is limited to the time absolutely necessary to perform the Services. Daily backups are kept for thirty days, and each third party document processing provider works under a stated zero retention arrangement. Data is returned or deleted at the customer's election within a reasonable period after the agreement ends, and the CCPA attachment requires prompt compliance with deletion requests. Access controls include role based authorization, least privilege, quarterly access reviews, multifactor authentication, encryption at rest, TLS of 256 bits or stronger in transit, and per tenant encryption keys. The subprocessor terms provide fifteen days' notice before additions, a right to object with termination and refund, and Conga's responsibility for provider acts. Incident notice comes within 48 hours of Conga becoming aware, backed by a response plan with root cause analysis and a 24/7 security team.
The privacy policy separates user data, customer agreements and AI inputs, and names the purposes for processing them. Users' personal data are deleted when their account or the customer contract ends, with limited identity history retained and backups kept for five years. Customers direct deletion of third party personal data in agreements. At termination, extraction is through REST APIs returning base64 content, so the customer needs its own conversion and storage capability. Published safeguards include encryption, role permissions, annual external penetration testing and an incident response team. A deadline for notifying customers of a breach and precise AI service retention exceptions are not supplied.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The Artificial Intelligence Addendum states that Conga makes no warranty, express or implied, on the accuracy, completeness, noninfringement or fitness for purpose of AI generated output. The customer is solely responsible for evaluating and validating that output. To the maximum extent permitted by law, Conga is not liable for any losses, damages or claims arising from the customer's use of or reliance on AI output or on actions by agentic AI features. That includes third party claims. One allocation runs the other way. The Data Processing Addendum makes Conga liable for its subprocessors' acts and omissions as if it had performed the services itself, and much of the AI pipeline sits with those third parties. The addenda do not state a general liability cap, an indemnity scope or an insurance position. Conga's Master Services Agreement is a separate document.
The August 2025 terms place responsibility for AI results on the user and disclaim accuracy, completeness and suitability. They expressly exclude netLex's liability for decisions, actions and omissions arising from use of AI functionality. Separate provisions also disclaim losses from errors in generated agreements and third party service failures. If netLex is nevertheless held liable, the stated ceiling is the amount the customer paid for the platform during the preceding twelve months. No published AI output indemnity, professional liability insurance commitment or compensation mechanism for a harmful clause is provided. A negotiated software license may contain additional provisions unavailable in these public user terms.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Several of Conga CLM's integrations are structural. One edition runs natively on Salesforce and is listed on the Salesforce AppExchange. Authoring and review run inside Microsoft Word and Google Docs, and Microsoft Dynamics is named on the product page. The platform edition supports connections to CRM, ERP and procurement systems. Within Conga's own products, pricing, terms and configurations flow from CPQ into a contract. Documents are generated through Composer and signed through Conga Sign, and price optimization feeds contract pricing. Developer resources cover APIs and integrations. Field mapping and sync directions for individual external connectors are not specified alongside the broader connections.
Salesforce and HubSpot integrations map CRM properties to variables in netLex contract templates. Customer identity, commercial amounts, payment terms, dates and opportunity stage can feed the agreement; the configured stage triggers generation. Contract creation history and the information used remain visible inside the CRM. Legal teams prepare the approved templates and the customer configures the field mapping and trigger. Gupy describes using this process for commercial amendments. netLex also supplies Slack notifications, directory authentication, signature connections and a REST API, with netLex Connect supporting custom input and output flows. Its announced MCP interface still lacks a separate public release confirmation.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The CLM has two delivery forms. One is the original application built on Salesforce. The other is a software as a service edition on the Conga Advantage Platform that gives buyers a CLM interface independent of Salesforce. The Data Processing Addendum treats them differently. It states that Conga does not back up customer data for services hosted on Salesforce and sets no recovery point objective for them. Elsewhere it keeps daily backups for thirty days, with a one hour recovery point objective and a twenty four hour recovery time objective. Infrastructure is named as Salesforce, Amazon Web Services and Azure, with data on servers managed by Salesforce and AWS. Each logical tenant boundary has its own encryption key. Availability is described as spanning the United States, the European Union and Asia Pacific with residency options included, which names continents rather than regions. A region list, the method of choosing a tenant's region and separate processing locations are not specified. Content reaches Azure OpenAI, Google Cloud Vision, Amazon Textract and Zuva, and the processing locations are not specified.
netLex runs on AWS and lets customers choose storage in the United States, Europe or South America. The privacy policy identifies the United States, Ireland and Brazil as contractual locations for storage or processing. It separately permits subcontracting and sharing with providers in other countries, including the United States. A selected repository region therefore does not establish that every AI request stays there. Backups are geographically distributed, without a separate public map of their locations. The native AI integration is with OpenAI, but its processing geography is not tied to each customer region. No customer hosted deployment option is described.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
SOC 2 Type II covers the full platform under annual audits, according to Conga. The trust center also lists ISO 27001, ISO 27701 as its privacy extension, PCI DSS, HIPAA Security with annual audits, GDPR and CCPA. It adds alignment to the NIST AI Risk Management Framework and certification under the EU-U.S. Data Privacy Framework. The Data Processing Addendum links that certification to the Department of Commerce register. The security program includes annual third party penetration testing, application vulnerability assessment twice a year, continuous automated threat hunting and code analysis before release. It also covers a patching service level by severity, background checks, annual security training and a vulnerability disclosure program. Auditor names, report periods, observation windows and certificate numbers are not available alongside those claims, and reports require a request. The Data Processing Addendum makes reports available on a customer's request under confidentiality, so a prospective buyer cannot read the audit scope before signing.
netLex states that it holds ISO 27001:2022 certification and obtains SOC 2 Type I and Type II reports through recurring audits. The reports are available by request under a nondisclosure agreement. The public security description also specifies annual external penetration testing, static code analysis, component vulnerability analysis and separation of development, test and production environments. Production data are excluded from development and testing. These are more specific assurances than an infrastructure badge alone. However, the public text does not identify the SOC auditor, report observation period or exceptions. AWS's separate certifications should not be treated as independent coverage of every netLex AI function.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Generative features run on Microsoft Azure OpenAI. The document processing agents also use Google Cloud Vision for optical character recognition, Amazon Textract for table detection and Zuva for provision extraction, each under a stated zero retention arrangement. The Azure OpenAI Service is described as fully controlled by Microsoft, hosted in Microsoft's own Azure environment and not interacting with any system operated by OpenAI. Prompts, completions, embeddings and training data are tokenized in transit, are not available to OpenAI, and are not used to improve OpenAI, Microsoft or third party models. Change notice is contractual. The AI providers are subprocessors, and the Data Processing Addendum gives fifteen days' notice before a new one is appointed, with its name, location and activity. It also gives a right to object, and termination with a refund if no workaround exists. No specific model is named. The Addendum refers to Azure OpenAI GPT, which is a family rather than a version, and nothing states which model writes a summary or a redline or when that changes.
OpenAI is identified as the provider behind netLex's native AI drafting and revision features. The privacy policy explains that the integration uses the OpenAI API, and the published supplier list also names OpenAI API and ChatGPT alongside AWS and other service providers. It does not identify a current model version for each agent or specify how those agents route tasks among models. Nor does it map OpenAI processing to the customer's selected storage region. Customers receive notice of privacy policy changes, but a distinct commitment to advance notice of model substitutions is absent. Newer agent features therefore need more detailed supply chain terms.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Conga CLM uses custom quotes without a numeric starting rate, a defined billing unit or a plan table. The application combines drafting, negotiation, approvals, electronic signature, contract storage and obligation management, with AI review and extraction inside that workflow. Additional products connect CPQ, document generation and signing to the wider suite. An advanced CLM feature set includes clause libraries, version control and redlining, but its incremental charge is not specified. Subscription duration, renewal provisions, price increase limits and implementation fees are not given with the quote request. The Master Services Agreement is separate from the AI and data processing addenda.
The monthly subscription normally depends on the number of users and their access profiles. It includes implementation and automation of an agreed number of documents; additional document automation is priced according to project complexity. Native integrations, including electronic signature connections, are included, while integrations needing special configuration receive a separate project price. This explains the charging structure without publishing a per user rate, minimum contract value or an AI consumption allowance. A quote must distinguish ordinary platform access from any agent entitlement or usage charge. Public materials do not settle renewal increases, termination charges or the total cost of a large migration.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Legal, procurement, sales, finance, IT, business operations and pricing teams use the suite. Their CLM tasks differ. Legal gets workflow, authoring, AI review and redlining, compliance and risk management. Procurement gets obligation management, AI extracted terms and pricing. Sales gets generation, AI assisted negotiation and renewals. Industry uses cover technology, financial services, healthcare, life sciences, manufacturing, transport and logistics, and distribution. Named customers span airlines, insurance, media, retail and property data. No practice area inside a legal department is named as supported or unsupported, and nothing states what the product is not for. Capability restrictions for users who are not lawyers are not specified inside a shared tenant. Jurisdiction and language coverage boundaries are also unspecified, although the product is localized into German and French.
netLex serves company legal, sales, procurement, finance and operations teams through contracts, powers of attorney, legal requests and related corporate records. Named customers include Ambev, Blip and Isaac, with Gupy illustrating commercial amendments generated from a CRM. Its templates and playbooks can cover supply agreements, employment contracts, confidentiality agreements and services contracts. The interface is offered in eleven languages and service is available in Portuguese, English and Spanish. Use in more than sixty countries describes geographic adoption, not verified legal coverage in each jurisdiction. The product does not publish an exhaustive set of supported laws, exclusions or a separate law firm matter management offering.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The Artificial Intelligence Addendum expressly permits training on customer content, within written limits. Section (c) says Conga will not use Customer Data to train global or foundational models that serve multiple customers. Any training on Customer Data is limited to models specific to the customer's instance or tenant. Permitted training is limited to the customer's own data and a model only that customer uses, and neither the Addendum nor the trust center describes an opt out.
Conga does not use Customer Data to train third party foundational models, naming Azure OpenAI GPT as the example. Section (d) says Conga will not let any third party use Customer Data or AI Output to train, fine tune, validate, test or otherwise develop any AI model. Section (b) says that, beyond a limited license to provide, maintain or improve the Services for that customer, Conga will not use AI Inputs or AI Outputs to train or improve any model.
The trust center adds that models trained on one customer's data are never used for another. One carve out is reserved. Service Attributes, defined as anonymized and aggregated usage information, may be used to train and refine models and are stated not to be Customer Data.
netLex's privacy policy expressly says that data supplied to its AI functionality will not train the model. It identifies the OpenAI API as the integration used for drafting and reviewing clauses. This is a published policy promise, rather than a separately supplied negotiated AI agreement. The prohibition concerns AI inputs; it does not erase ordinary contract storage, user history or the five year backup period. The policy does not provide model specific audit results or an enforcement mechanism against every underlying provider.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
The Data Processing Addendum lets the customer control retention by contractual instruction. Attachment A sets the default. Retention of personal data should generally not be required, and any retention is limited to the time absolutely necessary to perform the Services. Section 9.6 requires return and deletion at the customer's election within a reasonable period after the agreement ends, with the customer deleting within the Services and Conga helping where it cannot.
The CCPA attachment adds a duty to follow any customer deletion instruction promptly. Daily backups are kept for thirty days, except for services hosted on Salesforce, which Conga does not back up. At the model layer, Conga states a zero retention policy with each third party document processing provider. Documents sent to Azure OpenAI, Google Cloud Vision, Amazon Textract and Zuva are therefore processed in real time and not stored. No zero retention setting is offered to the customer inside the Services.
The AI product description says drafting and review data will not be stored, while the general privacy policy retains platform records under a separate schedule. User deletion or contract termination removes user personal data, subject to limited name and email history; backups persist for five years. Customers can request removal of third party personal data from agreements. These provisions distinguish transient AI processing from saved contract content, but do not enumerate provider abuse monitoring exceptions or a separate schedule for agent conversation histories.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Conga CLM has its own permission model, which the customer administers. Between customers, separation is built into the architecture. Tenant environments are logically separated, each with its own encryption keys, and models trained on one customer's data are never used for another customer's recommendations or scores. Inside a tenant, the Data Processing Addendum's security attachment requires role based authorization, least privilege, quarterly access reviews, multifactor authentication and the customer's ability to limit access to authorized personnel.
Rules based access controls, audit logs and admin tools help the customer configure and manage AiMe, which leaves the alignment work with the customer. The product does not apply an outside document management system's access model at query time. The addenda and trust center do not address segregation between matters or business units inside one tenant. The platform is sold to legal, procurement, sales, finance and IT in the same instance, and the assistant answers questions across the whole contract repository.
netLex describes AI permissions tied to the current user's profile and says agents cannot access data beyond what that person can see. It also describes a separate customer environment, with role permissions and corporate authentication supporting access control. This is a product permission model for corporate contracts, rather than inheritance of a law firm's document management system permissions. The materials do not describe adverse party conflicts, lateral hire screening or an administratively tested ethical wall between separate legal client matters.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 4 of the Data Processing Addendum's security attachment is headed Disclosure by Law. If Conga is required by law to disclose customer data, it will notify the customer as soon as practical where the law permits. It will also take all steps to give the customer an opportunity to prevent or limit the disclosure, an obligation to help and not only to inform. The CCPA attachment adds a slightly stronger commitment for personal information.
For a legally required disclosure unrelated to the contracted business purpose, Conga must first tell the customer and give it a chance to object or challenge the requirement, unless the law prohibits notice. Conga will also redirect a misdirected data subject request to the customer and will not respond without the customer's prior written consent unless legally required. No transparency report, aggregate demand count or reporting cadence is available.
The privacy policy permits disclosure in situations required by law or judicial decisions. It does not promise advance customer notification of a subpoena, an opportunity to contest the demand or a regular transparency report. A separate notification provision concerns a data subject asking netLex to delete information: the customer is notified so it can instruct the processor. That deletion procedure should not be read as notice of government access. The user terms also allow netLex to report suspected unlawful activity to authorities.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Conga CLM works from the customer's own material. That means contracts imported in bulk, including third party, legacy and acquired agreements, plus the customer's clause library, negotiation playbook and approved templates. The vendor states that precise models are built from the customer's own documents without the customer having to train them. The generative layer is named too. Azure OpenAI handles language processing, with Google Cloud Vision, Amazon Textract and Zuva for optical character recognition, table detection and provision extraction.
Conga states no rights basis for any of these sources and does not describe what the underlying foundation models were trained on. Zuva's extraction models are trained on contract collections rather than on the customer's documents, and they are named without any account of what sits behind them. On the customer's side, the Artificial Intelligence Addendum leaves the customer with all right, title and interest in its AI Inputs and AI Outputs and grants Conga only a limited license.
The AI features work with customer contracts, attachments, clause playbooks and internal policies. They are not accompanied by an identified collection of licensed case law, statutes or commentary. OpenAI is named as a model provider, but the provider name does not establish the legal sources or licenses behind any generated proposition. Questions about company policy and departures from approved contract wording can have a useful internal reference base. They do not carry a published promise of comprehensive, current legal authority for a jurisdiction.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
The product cites no cases, statutes or regulations, so checking authority for later history does not arise in its usual form. It works on the customer's own agreements, comparing drafts to a negotiation playbook, matching against an approved clause library, extracting obligations and dates, summarizing, and answering questions about the repository. Nothing it produces is a statement about the law that a lawyer would check for later treatment.
The nearest point is obligation and renewal tracking, where the question is whether a contractual date or duty is still live, and alerts and dashboards handle that. No feature checks legal authority for subsequent history.
netLex's clause review compares agreements with customer standards and can suggest revised wording. No citator integration, case treatment service or automatic validation of whether a cited decision remains good law is described. Its requirement that users assess AI accuracy before adoption is a general review obligation, not a documented legal authority validation workflow. A team using generated legal opinions would still need an external research source to assess authority, subsequent treatment and relevance to the law governing the contract.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Conga commits that AiMe shows how every recommendation is generated, that users see the reasoning behind AI driven actions, and that confidence scores appear wherever AiMe makes a suggestion. That gives a reviewer a signal for each suggestion. Conga does not describe what the system does when it cannot ground an answer. An explicit refusal response or unsupported extraction marker is not specified. Nor does it say what happens when a clause cannot be matched to the playbook or a question cannot be answered from the repository.
No evaluation results for that behavior are available. The Artificial Intelligence Addendum allocates the consequences instead. It says outputs may be inaccurate, incomplete or misleading, makes the customer solely responsible for validating them, and states that Conga does not monitor or review AI generated outputs. The precise behavior of the guardrails is not specified.
Review Agent flags departures from a configured playbook and explains their severity, while Intake Agent is described as routing complex requests to appropriate people. Neither description specifies when a model declines to answer because support is missing, how uncertainty is communicated or what happens when contract clauses conflict with its assumptions. The terms warn that results can be inaccurate and require human assessment.
They do not supply an abstention policy, confidence calibration or examples of a refusal when legal context is insufficient.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin tracks decisions worldwide where a court addressed hallucinated AI content, and records the tool implicated where known. It records no court order, opinion or disciplinary record naming Conga CLM or Conga. Two independent sanctions trackers of decisions on AI generated fabricated citations do not name them either. Conga CLM works on contracts and cites no legal authority, so its output does not ordinarily reach a court filing.
The Charlotin collection contained 2,191 cases at this review, with no whole word match for netLex in either the tool field or the full case material. That result is limited to reported incidents included in the collection and does not measure the product's error rate. netLex primarily supports company agreements and internal legal requests, and its terms explicitly acknowledge that AI results may be inaccurate. A lack of a named reported incident does not make a generated legal citation reliable.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
No bar or ethics guidance is named for the service. ABA Formal Opinion 512 does not appear, no state guidance on generative AI in legal practice is referenced, and nothing maps a capability to a jurisdiction's rules of professional conduct. Conga does cite outside frameworks, but none of them is professional responsibility guidance. The Artificial Intelligence Addendum ties governance to the NIST AI Risk Management Framework, and the trust center classifies the products as minimal or limited risk AI systems under the EU AI Act.
Both are addressed to the vendor as an AI provider. The nearest thing to a professional responsibility statement is the Addendum's requirement that the customer not rely on AI outputs as the sole basis for a decision with legal impact. It also requires the customer to exercise independent judgment. It names no guidance.
The terms require users to evaluate AI output and preserve necessary human legal analysis. netLex also discusses privacy, access permissions and final approval by a legal team. It does not map these arrangements to a named bar association opinion, professional conduct rule or jurisdiction specific guidance on legal AI. Compliance with the LGPD and GDPR concerns data protection and does not establish professional responsibility alignment.
Lawyers remain responsible for applying the conduct rules that govern their practice and the particular use of generated work.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product serves corporate teams managing their own commercial agreements. The named audiences are in house functions, legal, procurement, sales, finance, IT and business operations, each with its own page. The named customers are corporate, among them an airline, an insurer, a property data business, a consumer fitness company and a professional network. Nothing is addressed to a law firm billing a client. Conga's efficiency claims include a 9 percent revenue increase, 50 percent less review time with AI, faster deal cycles and lower supplier costs.
All of them concern the buyer's own cost, cycle time or revenue, and none reaches a client bill. The platform also runs quoting, pricing and billing, but that is the customer billing its own customers rather than a lawyer billing a client. No client fee disclosure workflow for AI assistance is specified.
netLex is sold for a company's own contracting and internal legal operations. The published savings concern productivity, amendment cycle time and business process costs, with subscription charges generally tied to users and their access profiles. Those claims do not describe lawyers charging external clients for time saved by AI. No legal fee allocation, client technology surcharge or invoice narrative is offered. Gupy's measured legal response time is an operational service level within a business, rather than a disclosure of billable legal time.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Customer counsel can use the AI and data processing addenda to address a counterparty's AI clause. Conga's trust center names Google Cloud Vision for optical character recognition, Amazon Textract for table detection, Zuva for provision extraction and Azure OpenAI for language processing. It states a zero retention arrangement with each and explains what Azure OpenAI does and does not do with prompts and completions.
The subprocessor register identifies the supporting services. The Data Processing Addendum applies Clause 9(a) Option 2 of the Standard Contractual Clauses to that list, with fifteen days' notice, a right to object and termination with a refund. The Data Processing Addendum includes the standard contractual clauses and their UK and Swiss adaptations, alongside the separate Artificial Intelligence Addendum.
A published supplier list identifies AWS, OpenAI, Microsoft, Google, Zendesk, signature services and other providers. The privacy policy explains AI input treatment, international transfers, deletion and the five year backup exception. Security reports can be requested under a nondisclosure agreement. These materials give a corporate team information to supply when a client asks about its technology, but do not constitute a named outside counsel approval workflow. The supplier list does not assign locations or detailed processing functions to every listed company.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
The platform keeps a complete audit trail of every action, approval and signature across the contract lifecycle, which the vendor describes as supporting legal or internal reviews. It also keeps version control, tracked edits and inline comments. AiMe shows how every recommendation is generated and the reasoning behind AI driven actions, and confidence scores accompany each suggestion, so the basis of a proposed clause is visible at review.
No report or extract is described as identifying which model produced a passage, and the model is not named beyond a family. Conga describes no document level export, no marking of machine generated text against human edited text in a form a party could give a court, and no disclosure template, certification form or court guidance.
netLex describes version history, approval tracking and AI interaction logs that distinguish automated actions from human decisions. Its privacy policy provides a REST API route for exporting stored agreements and data when a customer contract ends. The public description does not specify an export joining each prompt, model version, response and lawyer review into a court disclosure record. Contract negotiation history can support internal reconstruction of a drafting decision, but it is not a published filing certificate or a complete account of AI assistance for a court.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
- Bar Guidance Alignment
Which one fits
Choose Conga CLM if
- Contracting needs to align with a broader Conga commercial operations deployment.
- Teams want Word, Google Docs and browser authoring choices.
- A customer specific model arrangement is acceptable under the negotiated AI terms.
Choose netLex if
- The buying team wants a stated user and access profile charging structure.
- Portuguese, English or Spanish service fits the rollout.
- Legal intake and powers of attorney should share the contract platform.
In summary
Conga CLM
Conga CLM combines templates, negotiation, obligation tracking and AiMe review within a wider commercial suite. It supports a Salesforce application and the Conga Advantage Platform, with authoring in Word, Google Docs and a browser.
netLex
netLex links AI clause drafting and playbook review to legal workflows and CRM data. Monthly charges normally depend on user profiles, with agreed implementation and document automation included and custom integration work quoted separately.
Questions buyers ask
Can both Conga CLM and netLex work with Salesforce?
Yes. Conga offers a Salesforce application as well as its Advantage Platform edition. netLex maps CRM properties into template variables and can trigger contract generation from an opportunity stage. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Which model providers are named by Conga and netLex?
Conga identifies Microsoft Azure OpenAI for generative features. netLex identifies the OpenAI API, without publishing a current model version for each of its newer agents. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Does Conga's training restriction mean no customer model can be built?
No. Its terms permit certain models for that customer's benefit while restricting shared foundational training. The customer specific permission needs to be understood alongside the restrictions. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
How does netLex's training position compare with Conga's?
On the published AI input rule, AI Legal Index distinguishes netLex's policy prohibition from Conga's permission for customer specific models. Neither statement by itself defines every retention period or processing location.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Conga's Salesforce and Advantage Platform deployments have different implementation contexts. netLex's published charging structure omits a numeric subscription price.