Contractzy vs Docusign CLM: how they compare in 2026
A Docusign customer extending agreement operations beyond signature has a direct reason to evaluate Docusign CLM. It combines template generation, conditional review, version control, a repository, and a workflow builder with more than 100 preconfigured steps. Iris adds extraction and assisted negotiation. Contractzy also manages the full agreement lifecycle, with CORA focused on risk guidebooks, summaries, and obligation extraction. It can connect to Docusign for signature, so the choice is not simply which signing service the team uses. The more useful distinction is the process around signature: Docusign CLM offers a configurable enterprise workflow connected to systems such as Salesforce and SAP Ariba. Contractzy combines defined user and agreement packages with an option for customer premises installation. Both can centralize agreements, but their workflow configuration, implementation, and hosting requirements lead to different projects.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
CORA AI powers contract risk analysis, summarization, metadata extraction, and obligation management inside a broader contract lifecycle platform. Review starts with company guidebooks, while extraction turns scanned PDFs, images, and Word files into searchable information. Obligation management creates owners, milestones, deadlines, and renewal alerts from agreements. Templates, clause libraries, approvals, signatures, version history, and the repository remain useful without model inference. Essentials and Professional also separate conventional contracting functions from the fuller AI package in Enterprise. The models therefore run substantial review and analysis functions, while established workflow and storage features remain a separate part of the product.
The core of CLM is a workflow and document system. It generates contracts from templates, keeps a clause library, and stores agreements in a repository with reporting. A drag and drop workflow designer offers more than 100 preconfigured steps for generation, review, approval, signature and storage. That system dates from SpringCM, which Docusign agreed to buy in 2018, before generative AI was part of it. AI now drives several core functions. More than 100 pretrained models extract and report on contract data points and legal topics. AI-Assisted Review flags nonstandard clauses and suggests redlines against a playbook. Generative features summarize agreements, draft clauses on request and answer questions about the repository. Docusign brands the engine Iris and describes it as trained on decades of contract data. Workflows can start from analytics, risk scores and contract content, so extracted data drives routing as well as lookups in the repository.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Risk analysis highlights ambiguous clauses and departures from company guidebooks, then lets reviewers inspect changes through tracked redlines. CORA AI also extracts parties, dates, monetary terms, and obligations from uploaded agreements. Accuracy claims include 98% for risk detection, 95% or more for metadata extraction, and up to 99% in the pricing FAQ, without a defined evaluation set or error breakdown. The contract text supplies context, but a retrieval method with linked primary legal authority and citation treatment is unspecified. Severity labels describe contractual risk rather than confidence in an answer. Critical decisions still call for human review under the pricing guidance.
Docusign describes Iris as delivering accurate, secure and trusted agreement intelligence. Its AI Trust page says AI outputs have been tested for accuracy, and that diverse datasets and checks correct skewed outputs before release. Docusign publishes no figure, error rate, test set or evaluation method for CLM extraction, AI-Assisted Review or agreement summaries. The numbers it gives for the review product are time savings, such as 72 to 80 percent saved on contract reviews, with no stated baseline. Section 6.2 of the AI Attachment for Docusign Services, version 8 July 2026, warns that the AI may produce incorrect output, given the probabilistic nature of machine learning. The same section places review for accuracy on the customer. CLM works from the customer's own contracts and clause library rather than from law. Docusign does not describe how a summary or an answer links back to the clause it came from.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Reviewers upload a Word or PDF guidebook or generate one with AI, scan an agreement, and inspect highlighted risks and tracked revisions. Editable guidebooks encode company requirements, and alerts identify departures or high risk clauses. Contracts failing mandatory criteria are prevented from advancing until compliance is ensured. Legal teams retain control over precise edits, with approval routing and version history supporting review before execution. The pricing guidance recommends human review for critical decisions. The remaining uncertainty is the control path after an incorrect classification: the criteria configuration, override permissions, and escalation route for an AI error are not specified.
AI-Assisted Review suggests edits and flags risky language for a reviewer to accept or reject. CLM workflows send agreements with nonstandard terms to review under conditional rules the customer sets, and they can also be triggered automatically by analytics, risk scores and contract content. Every action sits in an audit trail of who did what and when, with version control across drafts. Section 6.2 of the AI Attachment makes the customer responsible for reviewing and evaluating AI output for accuracy and suitability, including through human review. The AI Trust page says the customer has the final say to approve outputs. Docusign does not set out what an AI step may do without a person, at what confidence an extraction is held for review, or what happens after an AI output is found to be wrong.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Legal leaders at Bajaj Markets, Bridgestone, and Easebuzz describe actual use of the platform. Manish Jain emphasizes responsive support; Reni Verghese describes managing contracts against timelines; Nitin Bhuwania describes reducing administrative effort and retrieving executed agreements after digitization. These accounts identify customers and concrete activities, although they do not supply dated before and after measurements. Separate CORA AI claims include an internal study of faster summarization and improved extraction, without a disclosed sample or method. Implementation generally takes two weeks to one month depending on integrations, customization, and migration. That estimate describes rollout effort rather than a measured customer outcome.
The CLM page carries four customer stories, each naming the customer, giving figures and quoting a named, titled speaker. T-Mobile Wholesale cut agreement time by 44 percent without adding headcount, with 1.8 times faster cycle time on high value agreements, says Janet Sutherland, Senior Manager of Sales Enablement. Keith McCarraher, Special Projects Manager at the automotive parts distributor, describes more than ten use cases across five departments. Vestwell reports agreement packages built in 5 minutes instead of 75 and 70 percent fewer drop offs, quoted by its COO, Jon Mark. At iCIMS, 78 percent of the company's agreements need no legal involvement, according to Courtney Dutter, Deputy General Counsel. The page also states a 449 percent return on investment, an 85 percent reduction in errors and 2,200 enterprise CLM customers, without naming the study or the customers behind those figures. No story gives a deployment date or a measurement method.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The agreement limits personal data use to delivering, maintaining, securing, and improving the contracted services under customer instructions. It covers contract files, attachments, metadata, communications, approval records, and access logs, and rules out selling customer data or unrelated advertising uses. Subprocessors must accept protections at least as strong as the agreement. Role permissions restrict visibility to authorized departments and users, while production access follows least privilege. The improvement permission contains no explicit model training exclusion. Privilege preservation, work product treatment, matter isolation during retrieval, and foundation model retention commitments remain unspecified, so these provisions do not settle every confidentiality question for a law firm.
The Docusign Master Services Agreement, version 14 November 2022, keeps Customer Data owned by the customer (3.1). Confidential information may be used only for the purpose given and must be protected with at least reasonable care (11.1). Liability for a breach of confidentiality sits outside the twelve month fee cap (10.2). The AI Attachment treats AI output as Customer Confidential Information. Section 4.1 of the AI Attachment grants Docusign a perpetual license to use CLM customer data and AI output, once anonymized and aggregated, to train models. Section 4.2 lets the customer switch that off going forward with a toggle in the product. Section 4.3 of the MSA separately lets Docusign use deidentified usage data, including for training. Within a customer account, CLM folder security limits who sees which contracts. The agreements and the product pages do not address privilege or work product.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Legal departments use CORA AI to identify contractual risks, make edits, and manage approvals, while procurement, sales, finance, and HR users share the broader workflow. Human decision authority is explicit in the product positioning, and critical decisions are subject to a recommendation for human review. The CORA AI introduction also directs customers to consult their legal departments about regulatory implementation. Those operating instructions do not establish an advice versus software boundary, permitted legal jurisdictions, or a position on unauthorized practice. The software terms disclaim warranties generally without a specific legal advice disclosure. Nonlawyer participation is supported without a corresponding professional responsibility framework.
Section 6.2 of the AI Attachment, the contract that governs CLM's AI features, states that neither Docusign, the AI Services nor AI output provide the customer with legal advice. The same section leaves suitability for any purpose to the customer's sole discretion and has the customer review output for accuracy, including through human review. CLM is sold to sales, procurement, human resources and customer experience teams as well as legal. AI-Assisted Review proposes redlines and drafts clauses for any of those users. Docusign does not say who in a customer reviews an AI redline before it reaches a counterparty, how the product supports a lawyer's competence and supervision duties, or whether any limit applies by jurisdiction.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
The CORA AI introduction describes pretrained language models refined through legal expert feedback, regular updates, and testing across legal scenarios. That establishes a quality aspiration but leaves release criteria, review ownership, evaluation sets, and results across contract types or jurisdictions unspecified. The model training description refers broadly to contracts, legal materials, and precedents rather than a traceable evaluation program. Prajot Borkar is the named data protection officer, responsible for privacy compliance; that role does not establish accountability for model behavior. Company guidebooks let customers impose their own contract policies, but they are distinct from governance of the vendor's models and training process.
Docusign publishes AI Trust and AI Innovation Principles pages for Iris, the engine behind CLM's AI features. The AI Trust page lists encryption in transit and at rest, consent based training on aggregated and anonymized data, and content filtering for harmful outputs. It also describes diverse datasets and checks that correct skewed outputs before deployment, and adoption of frameworks such as the NIST AI framework. Section 6.1 of the AI Attachment warrants that, to Docusign's knowledge, it holds sufficient permissions for the data used to train its own models. That data is defined as customer data authorized for that use, publicly available data and licensed data. Docusign names no person, committee or team as accountable for model behavior and lists no ISO/IEC 42001 certification. It publishes no test results, including on whether output differs across contract types, languages or regions. The AI Trust page says broader AI Trust capabilities are available through sales.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The May 2026 agreement identifies eight subprocessors and their functions, including AWS for hosting, Bedrock inference, and Textract processing. Controls include encryption, least privilege access, internal multifactor authentication, audit logs, restricted production access, monitoring, and backups. Incident procedures cover identification, investigation, management, and response. Customer notification follows a confirmed personal data breach without undue delay where legally required, rather than an unconditional fixed deadline. Data remains as long as needed for service, legal, dispute, or security purposes. Return or deletion follows a written request at termination within a commercially reasonable timeframe, with unspecified backup schedules and legal exceptions.
Under section 3.1 of the Service Schedule for Docusign CLM, version 15 September 2025, documents are stored for the subscription term or until the customer deletes them. An account administrator can set a different retention and deletion schedule. Retrieval is free during the term and available for 90 days after it through professional services, after which Docusign may delete the account and its documents (3.2). The Data Protection Attachment, version 4 September 2024, commits to notice of a data breach without undue delay, giving its nature, likely consequences and the measures taken. It also commits to deletion of personal data on request. Docusign's subprocessor list, last updated 18 September 2026, has its own CLM section naming each hosting and AI supplier with locations. Updates go out through an RSS feed, and objections go by email. Agreement contents are encrypted at rest, and folder security controls access inside an account. Section 4.1 of the AI Attachment lets Docusign keep training data derived from customer content after termination, with no duty to delete it. Docusign does not state what Microsoft or Google keep from prompts.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The software terms cap the operator's and suppliers' liability at the amount the client actually paid. Service comes as is and as available, with broad exclusions for warranties, fitness, noninfringement, accuracy of performance, and correction of errors. The agreement does not attach an indemnity, insurance commitment, or enforceable accuracy warranty to CORA AI output. It also excludes responsibility for incomplete or corrupt backups and places independent backup responsibility on the client. India is the defined country for governing law, with informal dispute resolution first. These terms allocate general software risk without promising a remedy for an incorrect contractual recommendation.
The Master Services Agreement, version 14 November 2022, warrants that the services perform substantially as documented (8.1). The remedy is repair, replacement, or termination and a prorated refund. Docusign indemnifies the customer against third party claims arising from its breach of confidentiality and from intellectual property infringement (9.1). Liability is capped at fees paid for the service in the twelve months before the first event (10.2). The cap does not apply to indemnity obligations, confidentiality breaches, gross negligence or willful misconduct. The AI Attachment narrows these terms for AI. Section 6.2 disclaims all warranties on AI output and says Docusign is not liable for output to the extent it includes customer data. It also removes the indemnity where a claim arises from the customer's data, its own modifications or output it knew to infringe. The agreements do not cover loss from a wrong extraction or redline, and Docusign publishes nothing on insurance.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Salesforce users can create, approve, and sign contracts within their CRM, while HubSpot data can generate agreements and feed approval and signature steps. Oracle supports contract creation and management, and Jira tickets initiate creation and approvals. Slack brings contract updates and actions into team conversations; Gmail supports workflows from the inbox. DocuSign, Adobe Sign, and UAE Pass provide signature connections, with Zoho also supporting contract generation and tracking. Custom APIs and integrations are available. Field mappings, authentication setup, synchronization conflicts, and permission propagation are not described, so the connection list does not establish a complete implementation specification for each workflow.
Docusign's Salesforce integration for CLM generates documents and runs workflows across Salesforce Customer 360. With SAP Ariba, users create supplier agreements, ingest third party paper and track workflow tasks from Ariba. The Coupa integration lets contracts be created or updated in either system. Slack carries review notifications and actions, and comments sync between Microsoft Word, Google Docs and CLM. AI-Assisted Review runs inside Word, and Docusign eSignature is built in. The CLM API in the Docusign Developer Center offers object, task and content APIs for Salesforce and custom applications. Docusign Monitor, sold as an extra on top of CLM, reports CLM event activity, including through Splunk. Docusign University runs courses on building custom CLM integrations. The named integrations include no document management system used by law firms, such as iManage or NetDocuments. The product pages do not say which fields move in which direction for each connector.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
AWS cloud hosting is the standard delivery route, with an additional single tenant cloud option and deployment on customer premises. Implementation scope depends on integrations, migration, and customization, and Enterprise includes custom integration and deployment options. The agreement identifies AWS operations as global, including India, Singapore, and the United States, while other processors operate in additional global locations. Cross-border safeguards may include applicable standard contractual clauses. These locations describe the processor network rather than selectable customer residency regions. The division between contract storage, model inference, OCR processing, and backup locations is not specified for each deployment option or subscription tier.
Docusign's subprocessor list names CLM's hosting suppliers and places each by where the service is provisioned. The hosts are Equinix in the Netherlands, the United Kingdom and the United States, Switch in the United States, and Microsoft Azure in the United States, Australia, Canada, the European Union and Japan. AI processing is listed separately. Azure AI services for review, summaries and extraction run in the United States, Canada, the European Union, Australia and Japan. Google processing for the CLM Analyzer service runs in Belgium, Canada, Germany, Switzerland, the United Kingdom and the United States. Government editions are separate deployments. The CLM Service Schedule keeps government customer data inside Docusign's FedRAMP Moderate boundary unless a connector exports it (5.2). The DoD Impact Level 4 edition requires a connection to NIPRnet through a boundary cloud access point (5.3). Docusign does not describe the tenancy model for commercial customers and offers no on premises option.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
The company identifies itself as ISO 27001:2022 certified and describes encryption, AWS hosting, role permissions, and restricted production access. Its agreement adds TLS 1.2 or later, internal multifactor authentication, continuous monitoring, security alerts, and backup and recovery measures. On a reasonable written request, the company may provide existing compliance material, certifications, or third-party audit reports instead of a disruptive audit. A current certificate scope, validity period, and directly accessible report are not supplied with these statements. Generic security language and a badge do not establish the scope of a separate SOC 2 examination or an AI-specific assurance program.
The certifications page Docusign publishes lists ISO/IEC 27001:2022 certification enterprise wide, ISO/IEC 27017:2015 and 27018:2019, and PCI DSS 4.0. Annual SOC 1 Type II and SOC 2 Type II audits cover all production operations, including data centers. FedRAMP agency authorization, GovRAMP authorization and a Defense Information Systems Agency Impact Level 4 provisional authorization each name CLM directly. Reports and certificates are available in the Docusign Trust Portal, and the annual CSA STAR CAIQ is public on the CSA registry. Docusign also completes the Shared Assessments SIG, S&P Global KY3P and ProcessUnity assessments each year. USDM assesses its 21 CFR Part 11 module annually. C5 Type II covers the eSignature product only and does not extend to CLM.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Amazon Bedrock supplies AI and machine learning processing, and Amazon Textract handles OCR and document processing within the AWS subprocessor role. CORA AI uses an array of pretrained language models and a training process involving legal contracts, materials, precedents, and expert feedback. This identifies infrastructure and broad architecture, while leaving the foundation model families, versions, routing rules, and fine-tuning arrangements unnamed. Subprocessors may change as technical or operational needs evolve. The agreement does not commit to advance model change notices or identify which model handles a particular risk review, summary, or obligation extraction. Provider locations likewise do not assign inference to a particular region.
The October 2026 subprocessor list assigns AI suppliers to specific CLM features. Azure OpenAI Service handles current AI Assisted Review and agreement summaries, while Azure AI Document Intelligence handles extraction. Google processes CLM Analyzer, and Docusign's DocuSmart subsidiary, trading as Lexion, handles legacy AI Assisted Review for selected United States customers. Countries are specified by service provisioning, and customers can subscribe to updates and object on data protection grounds. Model families and versions are not identified for these CLM services. Gemini naming in the separate Agreement Manager section does not establish that CLM uses the same model or configuration.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Essentials supports up to three users and 50 contracts each month; Professional allows up to ten users and 200 contracts; Enterprise starts above ten users with 500 monthly contracts. Each base subscription requires a quote. The pricing matrix lists Professional AI risk analysis at $40 per user per month, with up to 100 analyses monthly, while Enterprise includes 20 free reviews. Unlimited storage and distinct signature allowances accompany the plans. Reviewers need no additional license. Integrations, customization, migration, and deployment affect implementation scope, but their charges are not stated. The AI add-on figure therefore does not represent the total cost of running the platform.
A CLM subscription is prepaid and measured by a seat allowance, a document count or both, depending on the edition (4). The Service Schedule for Docusign CLM publishes that charging structure, but Docusign publishes no CLM price. Every call to action on the CLM page, Get Started included, goes to Contact Sales. The site's plans and pricing links lead to eSignature and IAM plans, none of which includes CLM. Under section 4.3, extra seats are charged pro rata at list price for the rest of the term. Documents over the count are charged per document at list price and invoiced monthly in arrears. Seats can be reassigned between people without penalty, and documents exported and then deleted during the term still count. Retrieval after the term ends is a paid professional services engagement. Editions named across Docusign's documents include CLM Essentials, CLM, CLM+ and the AI Extension for CLM, alongside government and DoD Impact Level 4 editions.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
The primary audience is corporate legal operations alongside procurement, finance, sales, HR, compliance, and operational teams. Legal workflows include drafting, negotiation, risk review, approval, execution, repository retrieval, and ongoing obligations. Sector offerings include fintech, automotive, manufacturing, healthcare, software, real estate, logistics, and other commercial industries. Templates and guidebooks adapt review to company policies, while repository filters include jurisdiction, expiry, and contract value. Regional offerings span Europe, the Americas, Asia, and the Middle East, but a jurisdiction and language support matrix is unspecified. Litigation research, court filing, and consumer legal representation are not established parts of the contracting service.
CLM is sold to legal, sales, procurement, human resources and customer experience teams. Its named customer stories come from wholesale telecom, auto parts distribution, retirement plan administration and recruiting software. Government use runs through CLM Government Products, authorized under FedRAMP and GovRAMP, and a DoD Impact Level 4 edition. Docusign says 2,200 enterprises use CLM for contract management. Its integrations with SAP Ariba and Coupa point at procurement as well as sales contracting. Docusign frames coverage by department and industry rather than by contract type or area of law. It names no minimum customer size, no law firm use, and no contract types the AI handles poorly. The IAM plans page states AI extraction in English, French and German, and the CLM pages give no language list.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The DPA allows personal data use for providing, maintaining, securing, and improving the services, subject to customer instructions. Contract files, attachments, and related workflow records fall within that processing scope. The improvement right has no explicit model training exclusion, while advertising profiling and unrelated commercial uses are prohibited. This is a contractual permission for improvement, not a statement that customer contracts actually train CORA AI.
Section 4.1 of the AI Attachment for Docusign Services, version 8 July 2026, grants Docusign a perpetual license to use customer data and AI output to train models and improve its services generally. The data and output are anonymized and aggregated first. The attachment's applicability table says customers on a Master Services Agreement consent to that training for Docusign CLM. Section 4.2 lets the customer opt out at any time with a toggle in the product, on a going forward basis.
Docusign keeps the training data created before the opt out, with no duty to delete it. The AI Trust page describes the same program as consent based. Customers whose subscription began before 8 July 2026 are pointed to earlier versions of the terms.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Personal data remains for as long as needed to operate the service, meet legal obligations, resolve disputes, and enforce agreements. Written requests at termination can trigger return or deletion within a commercially reasonable timeframe. Backup copies persist under unspecified schedules, with legal, security, and audit exceptions. No routine duration is assigned specifically to prompts, generated summaries, or review outputs while the subscription remains active.
Section 3.1 of the Service Schedule for Docusign CLM, version 15 September 2025, keeps each stored document, including the customer data in it, for the subscription term or until the customer deletes it. The account administrator can set a different retention and deletion schedule. After the term, documents can be retrieved for 90 days through professional services, and Docusign may then delete them (3.2). The schedule covers stored documents rather than prompts as such.
AI output is Customer Confidential Information under the AI Attachment. The same attachment lets Docusign keep anonymized training data derived from content, with no duty to delete it. Docusign does not state what the Azure and Google model services keep from a prompt.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Department and user permissions limit visibility into contract status, approvals, obligations, and renewals. The DPA also specifies role permissions, least privilege, and restricted production access. Neither provision explains how CORA AI retrieval enforces a law firm's matter walls or inherits permissions from an external document system. Single tenant deployment separates organizations, but does not by itself establish boundaries between conflicting matters inside one organization.
CLM has its own permission model built on folders. A Docusign employee's guide on the Docusign Community sets out six levels. They run from No Access, the default for all content, through View, View and Create, View and Edit, and View, Edit and Delete, to full control with Set Access. Security can be set for a user, a permission profile or a user group. Folders inherit their parent's security unless it is set explicitly.
CLM administrators can see all content whatever the folder settings. The CLM page adds granular permissions controls and an audit trail of who did what and when. Docusign does not say how AI review, summaries or repository lookups apply folder permissions when they run.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
The DPA requires prompt notice when a data subject requests access, correction, deletion, or another personal data right. That obligation concerns individuals exercising privacy rights, not subpoenas or government demands for customer contracts. The software terms and privacy provisions do not establish a separate commitment to tell customers before responding to compulsory legal process. Breach notifications are also a different event and do not settle this question.
Section 11.2 of the Master Services Agreement, version 14 November 2022, requires prompt written notice before a compelled disclosure of confidential information, unless legal process forbids it. It also requires cooperation in seeking a protective order. The Data Protection Attachment adds prompt notice of any government request about personal data. Docusign's law enforcement page says the company notifies customers when their data is subject to disclosure and withholds notice only under a signed nondisclosure order or a statute that bars it.
The page adds that Docusign cannot decrypt agreement contents at rest. Docusign prepares an annual transparency report on requests and makes it available to data protection authorities on request. The report is not published. Section 2(d) of the CLM Service Schedule says Docusign is not responsible for producing customer documents to any third party.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Risk review uses customer guidebooks uploaded in Word or PDF, company playbooks, and the contract being analyzed. CORA AI's training description also refers to broad datasets of legal contracts, materials, and precedents. It does not identify a primary law collection, its licensing basis, or an update schedule for individual sources. A company policy guidebook supplies contractual positions, but does not establish the origin or currency of legal authorities.
CLM works from the customer's own contracts, templates and clause library, and does not retrieve case law or legislation. Docusign describes Iris, the engine behind it, as trained on decades of contract data. Section 6.1 of the AI Attachment lists the training data for Docusign's own models as customer data authorized for training, publicly available data and data licensed from third parties. Docusign warrants that to its knowledge it holds sufficient permissions for them.
The section names no specific source or license, and it excludes the data third party providers used for their own models.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
CORA AI scans agreements for risky clauses and deviations from a company's guidebook, then presents severity labels and suggested revisions. No case treatment indicator or connection to a named legal citator accompanies that review workflow. Regular legal updates are a general training claim rather than a check on an authority's subsequent history. The human review recommendation concerns critical decisions and does not describe automatic verification that cited law remains valid.
Docusign CLM manages a customer's own agreements and does not cite case law or legislation, so a citator is not part of the product. The CLM page, the AI-Assisted Review page and the AI Trust page do not address checking authority for later history. Docusign does not describe how CLM detects when an amendment or a policy change leaves extracted terms or clause library positions out of date.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Critical, high, medium, and low labels prioritize the contractual significance of a detected issue. They do not measure the model's confidence or describe what happens when an answer lacks support. Mandatory compliance criteria can stop a contract from advancing, but that workflow restriction is separate from an AI refusal to answer. The risk and summary workflows do not specify an unsupported-answer response or a grounding threshold shown to reviewers.
Section 6.2 of the AI Attachment warns that AI output may be incorrect or otherwise undesirable and makes the customer responsible for reviewing it. The AI Trust page describes content filtering for harmful outputs. Neither document says what AI-Assisted Review or the question and answer feature does when a playbook or the repository does not cover what is asked. Nor do they say how a doubtful extraction is marked before it feeds a report, a renewal alert or a workflow rule.
Docusign documents no path for CLM's AI features to decline an answer and publishes no confidence or grounding scores for extraction, review or summaries.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court finding involving Contractzy, CORA AI, or The Legal Capsule appears in the AI Hallucination Cases database as of October 15, 2026. The current name and former brand produced no relevant match across its 2,191 entries. This dated result concerns reported proceedings. It does not establish that generated clauses or legal assertions are accurate, or rule out a proceeding outside that collection.
The AI Hallucination Cases database maintained by Damien Charlotin tracks court decisions worldwide that address hallucinated AI content and records the tool involved where known. It has no entry naming Docusign, Docusign CLM, Iris, SpringCM or Lexion, in the tool field or anywhere in the case text. CLM manages commercial agreements rather than producing court filings, so its output does not ordinarily reach a brief.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
The CORA AI introduction encourages customers to involve their legal departments when aligning implementation with regulatory requirements. Product guidance also recommends human review for critical decisions. These directions do not engage with a named bar opinion, client consent standard, or professional competence rule. The intended corporate legal audience and collaboration with nonlawyer departments are clear, while a jurisdiction-specific ethics mapping for use of AI in legal work remains unspecified.
Section 6.2 of the AI Attachment for Docusign Services, which governs CLM's AI features, states that neither Docusign, the AI Services nor AI output provide the customer with legal advice. It makes the customer responsible for reviewing output for accuracy and suitability, including through human review. The CLM page, the AI-Assisted Review page, the AI Trust page and the agreements name no bar opinion, ethics rule or professional conduct guidance.
Docusign's compliance work covers data, security and sector regimes, including ISO, SOC, PCI DSS, FedRAMP, GovRAMP, DoD Impact Level 4, HIPAA and 21 CFR Part 11. Those regimes bind Docusign as a provider rather than a lawyer using the product.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
CORA AI is positioned for corporate departments managing their employer's contracts, alongside procurement, sales, finance, and HR. Faster review, metadata extraction, and obligation tracking reduce those teams' own administrative costs. That workflow does not ordinarily create a bill from outside counsel to a client. Subscription charges and AI add-on units price the software, while no client time-entry adjustment or legal fee disclosure feature is described for the core corporate use case.
Enterprise legal, sales, procurement, and HR teams use CLM for their employer's agreements. Customer examples include T-Mobile Wholesale, Vestwell, and iCIMS, whose outcomes concern internal contracting speed and administrative effort. Vestwell reduced agreement package creation from 75 minutes to 5 minutes, while iCIMS attributes reduced legal intervention to its workflow. These are corporate operating costs rather than outside counsel invoices, and CLM does not specify a client fee adjustment for AI assisted work.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The DPA names AWS, Razorpay, DocuSign, Zoho Sign, emSigner, Digio, OnlyOffice, and Mailgun with locations and purposes. AWS includes Amazon Bedrock for AI processing and Textract for OCR, giving procurement teams a concrete starting point for provider disclosure. Foundation model versions and a client consent package are unspecified. Subprocessors may change with operational needs, without a separate advance-notification period or customer objection process in the listed terms.
Docusign's subprocessor list, last updated 18 September 2026, is published as a web page and a download, with a separate section for CLM. It names each hosting supplier and each AI supplier against the feature it powers, with countries and a contact address. Changes go to an RSS feed, with an email route for objections. The Data Protection Attachment, the AI Attachment, the Master Services Agreement and the CLM Service Schedule are all published without a login.
The certifications page and the public CSA STAR CAIQ cover security. Together these documents name every model provider that touches CLM content, and a customer can forward them when its own clients ask about AI vendors.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Tracked revisions, version history, contract audit trails, and approval records preserve parts of the drafting and review process. Legal teams can see changes and updates as agreements move through the lifecycle. Those records do not establish a per-contract export identifying the model, retrieved sources, and a human's verification of each AI result. The platform addresses commercial contract execution; a court filing disclosure or certification workflow is not specified.
CLM keeps an audit trail of who did what and when, and detailed version control across drafts, so the history of a contract can be reconstructed. Docusign does not say whether an AI-Assisted Review suggestion, an AI drafted clause or an AI extraction is marked as machine generated in that history. Nor does it say whether the audit trail records which model produced it. It publishes no export built for disclosing AI involvement and no disclosure template.
CLM output is a contract, a report or an obligation record rather than a court filing. A record of AI involvement would most likely go to a counterparty, an auditor or a regulator.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
- Refusal and Uncertainty Behavior
Which one fits
Choose Contractzy if
- You want Docusign signing within a separate contract management application.
- An on premises CLM deployment is part of the required architecture.
- Risk guidebooks and ownership of extracted commitments define the intended legal workflow.
Choose Docusign CLM if
- Your agreement program is expanding within the Docusign product environment.
- The process requires reusable workflow steps and conditional review routing.
- Contract generation and procurement need connections to Salesforce, SAP Ariba, or Coupa.
In summary
Contractzy
Contractzy manages contracts from creation through approval and signing to renewal monitoring. Its integrations include Docusign, Adobe Sign, and UAE Pass, allowing signature to remain a connected step in the process. The AI Legal Index identifies CORA's conversion of contract language into assigned commitments as a useful extension beyond execution. Guidebook review and shared summaries support the earlier negotiation. Organizations can choose hosted delivery or customer premises installation, with feature access shaped by the selected package.
Docusign CLM
Docusign CLM generates agreements from templates and business data, routes review, and keeps version history through negotiation. A drag and drop builder combines more than 100 workflow steps. The AI Legal Index highlights conditional review and the reusable workflow structure as practical controls for repeatable contracting. Iris supplies AI assisted review, extraction, summaries, and agreement questions. The repository supports reporting on obligations and renewals, while connections to Salesforce, SAP Ariba, and Coupa link the process to commercial systems.
Questions buyers ask
Can Contractzy use Docusign without replacing its CLM workflow?
Yes. Contractzy offers a Docusign connection for signing and tracking agreements. That integration does not make Contractzy the same product as Docusign CLM. From the AI Legal Index, based on each vendor's own published materials as of October 15, 2026. No vendor pays for placement.
What does Docusign CLM add beyond electronic signature?
It adds contract preparation, negotiated revisions, approval routing, a searchable repository, and ongoing reporting. AI functions help extract terms and review agreements before execution. From the AI Legal Index, based on each vendor's own published materials as of October 15, 2026. No vendor pays for placement.
How does Docusign CLM handle nonstandard language?
Legal teams can maintain approved clauses and conditional review rules. AI assisted review applies playbooks and suggests language while the workflow routes the agreement to the appropriate reviewers. From the AI Legal Index, based on each vendor's own published materials as of October 15, 2026. No vendor pays for placement.
What deployment choice most clearly separates Contractzy here?
Contractzy explicitly offers installation on customer premises alongside its cloud service. That option concerns where the contract application runs, separate from which electronic signature provider a team connects. From the AI Legal Index, based on each vendor's own published materials as of October 15, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Docusign CLM belongs to Docusign's product family and is distinct from a standalone eSignature subscription. Contractzy's use of a Docusign integration is a connector relationship, not common ownership.