Docusign CLM vs netLex: how they compare in 2026
Docusign CLM is a candidate for enterprises building contract operations around Docusign signatures, a maintained clause library and approval workflows assembled from more than one hundred steps. netLex offers a different operating emphasis: company agreements, powers of attorney and legal requests, with CRM generated contracts and regional service in Portuguese, English and Spanish. Both put AI review and extraction inside a broader lifecycle system. Training permissions deserve close attention. Docusign's July 2026 AI attachment permits specified anonymized or aggregated use with an applicable prospective opt out, while netLex's privacy policy says AI inputs will not train the model. For that decision, AI Legal Index finds netLex's published input promise simpler, though it does not eliminate its five year backup period. Docusign may fit a complex existing agreement infrastructure; netLex may fit teams prioritizing regional operations and coordinated commercial intake.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The core of CLM is a workflow and document system. It generates contracts from templates, keeps a clause library, and stores agreements in a repository with reporting. A drag and drop workflow designer offers more than 100 preconfigured steps for generation, review, approval, signature and storage. That system dates from SpringCM, which Docusign agreed to buy in 2018, before generative AI was part of it. AI now drives several core functions. More than 100 pretrained models extract and report on contract data points and legal topics. AI-Assisted Review flags nonstandard clauses and suggests redlines against a playbook. Generative features summarize agreements, draft clauses on request and answer questions about the repository. Docusign brands the engine Iris and describes it as trained on decades of contract data. Workflows can start from analytics, risk scores and contract content, so extracted data drives routing as well as lookups in the repository.
netLex combines a contract lifecycle platform with AI for clause drafting, review, extraction and questions about agreements. Its OpenAI integration lets users simplify, translate or revise clauses with prepared or custom prompts. Review Agent compares incoming contracts with the customer's playbook, while Creation Agent turns an existing document into questionnaire fields and variables. Management Agent extracts dates, parties, amounts and obligations for portfolio monitoring. Those capabilities sit within a wider system of templates, approvals, negotiation, signatures and storage that can operate without generation. The June 2026 agent announcement also describes an early access program; creating templates from a description alone was still forthcoming.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Docusign describes Iris as delivering accurate, secure and trusted agreement intelligence. Its AI Trust page says AI outputs have been tested for accuracy, and that diverse datasets and checks correct skewed outputs before release. Docusign publishes no figure, error rate, test set or evaluation method for CLM extraction, AI-Assisted Review or agreement summaries. The numbers it gives for the review product are time savings, such as 72 to 80 percent saved on contract reviews, with no stated baseline. Section 6.2 of the AI Attachment for Docusign Services, version 8 July 2026, warns that the AI may produce incorrect output, given the probabilistic nature of machine learning. The same section places review for accuracy on the customer. CLM works from the customer's own contracts and clause library rather than from law. Docusign does not describe how a summary or an answer links back to the clause it came from.
Review Agent compares clauses with a company playbook and explains departures from its standards. netLex also describes questions about contracts and attachments, including inconsistencies between the main agreement and a commercial appendix. These are useful sources of context, but the product materials do not demonstrate an openable citation for each answer or a method for validating cited legal authorities. No reproducible accuracy test, sample size or breakdown of missed risks is published. The terms explicitly warn that AI responses may be inaccurate, incomplete or unsuitable. A reviewer therefore has to compare proposed changes with the agreement and applicable law before relying on them.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
AI-Assisted Review suggests edits and flags risky language for a reviewer to accept or reject. CLM workflows send agreements with nonstandard terms to review under conditional rules the customer sets, and they can also be triggered automatically by analytics, risk scores and contract content. Every action sits in an audit trail of who did what and when, with version control across drafts. Section 6.2 of the AI Attachment makes the customer responsible for reviewing and evaluating AI output for accuracy and suitability, including through human review. The AI Trust page says the customer has the final say to approve outputs. Docusign does not set out what an AI step may do without a person, at what confidence an extraction is held for review, or what happens after an AI output is found to be wrong.
Administrators must enable the OpenAI functionality before users can access it, and customer policies govern its use. A reviewer can accept, edit or reject suggested wording, with the final contract remaining under human control. netLex describes additional approval steps for important negotiation changes and a Review Agent configured against the customer's clause rules and acceptable limits. Its July 2026 explanation distinguishes automated actions from human decisions in the history. The precise uncertainty level that stops an agent, mandatory escalation triggers and the procedure for undoing an erroneous downstream action are not published. The terms require users to assess AI results before adopting them.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
The CLM page carries four customer stories, each naming the customer, giving figures and quoting a named, titled speaker. T-Mobile Wholesale cut agreement time by 44 percent without adding headcount, with 1.8 times faster cycle time on high value agreements, says Janet Sutherland, Senior Manager of Sales Enablement. Keith McCarraher, Special Projects Manager at the automotive parts distributor, describes more than ten use cases across five departments. Vestwell reports agreement packages built in 5 minutes instead of 75 and 70 percent fewer drop offs, quoted by its COO, Jon Mark. At iCIMS, 78 percent of the company's agreements need no legal involvement, according to Courtney Dutter, Deputy General Counsel. The page also states a 449 percent return on investment, an 85 percent reduction in errors and 2,200 enterprise CLM customers, without naming the study or the customers behind those figures. No story gives a deployment date or a measurement method.
Gupy provides a named example of deployment with operational figures. In netLex's September 2026 account, Gupy simplified its commercial amendment language, introduced defined approval responsibilities and connected Salesforce before measuring changes in the first months. Average amendment completion fell from 38 to 25 days, while legal response time fell from 1.58 to 0.31 day. Amendments signed without customer changes increased from 16% to 60%. The account attributes the improvements to a combined process and integration project, not an isolated AI intervention. Exact observation dates, document counts and an independently reviewed measurement protocol are absent, limiting comparisons with other organizations.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The Docusign Master Services Agreement, version 14 November 2022, keeps Customer Data owned by the customer (3.1). Confidential information may be used only for the purpose given and must be protected with at least reasonable care (11.1). Liability for a breach of confidentiality sits outside the twelve month fee cap (10.2). The AI Attachment treats AI output as Customer Confidential Information. Section 4.1 of the AI Attachment grants Docusign a perpetual license to use CLM customer data and AI output, once anonymized and aggregated, to train models. Section 4.2 lets the customer switch that off going forward with a toggle in the product. Section 4.3 of the MSA separately lets Docusign use deidentified usage data, including for training. Within a customer account, CLM folder security limits who sees which contracts. The agreements and the product pages do not address privilege or work product.
The privacy policy states that inputs supplied to netLex AI will not train the model, and the product description says drafting and review data are not retained by the AI service. Access controls use roles, corporate authentication and customer permissions. netLex describes agents as unable to reach information beyond the current user's access, with a separate customer environment. Contract storage nevertheless has its own lifecycle: deleted user records can leave name and email history, and backups remain for five years. The public terms do not directly promise preservation of attorney privilege or explain how model provider access affects work product protection.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Section 6.2 of the AI Attachment, the contract that governs CLM's AI features, states that neither Docusign, the AI Services nor AI output provide the customer with legal advice. The same section leaves suitability for any purpose to the customer's sole discretion and has the customer review output for accuracy, including through human review. CLM is sold to sales, procurement, human resources and customer experience teams as well as legal. AI-Assisted Review proposes redlines and drafts clauses for any of those users. Docusign does not say who in a customer reviews an AI redline before it reaches a counterparty, how the product supports a lawyer's competence and supervision duties, or whether any limit applies by jurisdiction.
netLex is aimed at legal departments and the business teams working with them on company agreements. Its terms require users to assess the relevance, accuracy and suitability of AI results before adopting them for any purpose. They also state that AI cannot replace necessary human, legal, technical or professional analysis. The drafting interface supports this division by leaving acceptance or rejection of suggestions with the user. However, jurisdictional limits on automated legal opinions and a detailed account of lawyers' competence or supervision duties are not supplied. Corporate staff can initiate contracts and requests without being lawyers, making the configured approval route significant.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Docusign publishes AI Trust and AI Innovation Principles pages for Iris, the engine behind CLM's AI features. The AI Trust page lists encryption in transit and at rest, consent based training on aggregated and anonymized data, and content filtering for harmful outputs. It also describes diverse datasets and checks that correct skewed outputs before deployment, and adoption of frameworks such as the NIST AI framework. Section 6.1 of the AI Attachment warrants that, to Docusign's knowledge, it holds sufficient permissions for the data used to train its own models. That data is defined as customer data authorized for that use, publicly available data and licensed data. Docusign names no person, committee or team as accountable for model behavior and lists no ISO/IEC 42001 certification. It publishes no test results, including on whether output differs across contract types, languages or regions. The AI Trust page says broader AI Trust capabilities are available through sales.
netLex publishes principles for AI use in contracts: company playbooks, access permissions, traceable decisions and final human approval. It describes logs that distinguish automated decisions from human actions and presents these controls as part of its own design. That establishes an AI governance position, but not a full account of how the vendor tests its models. No named owner for model risk, release evaluation protocol, bias assessment across languages or results across contract types are supplied. The Information Security and Compliance Committee oversees security and privacy; its existence alone does not show accountability for uneven legal output or model behavior.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Under section 3.1 of the Service Schedule for Docusign CLM, version 15 September 2025, documents are stored for the subscription term or until the customer deletes them. An account administrator can set a different retention and deletion schedule. Retrieval is free during the term and available for 90 days after it through professional services, after which Docusign may delete the account and its documents (3.2). The Data Protection Attachment, version 4 September 2024, commits to notice of a data breach without undue delay, giving its nature, likely consequences and the measures taken. It also commits to deletion of personal data on request. Docusign's subprocessor list, last updated 18 September 2026, has its own CLM section naming each hosting and AI supplier with locations. Updates go out through an RSS feed, and objections go by email. Agreement contents are encrypted at rest, and folder security controls access inside an account. Section 4.1 of the AI Attachment lets Docusign keep training data derived from customer content after termination, with no duty to delete it. Docusign does not state what Microsoft or Google keep from prompts.
The privacy policy separates user data, customer agreements and AI inputs, and names the purposes for processing them. Users' personal data are deleted when their account or the customer contract ends, with limited identity history retained and backups kept for five years. Customers direct deletion of third party personal data in agreements. At termination, extraction is through REST APIs returning base64 content, so the customer needs its own conversion and storage capability. Published safeguards include encryption, role permissions, annual external penetration testing and an incident response team. A deadline for notifying customers of a breach and precise AI service retention exceptions are not supplied.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The Master Services Agreement, version 14 November 2022, warrants that the services perform substantially as documented (8.1). The remedy is repair, replacement, or termination and a prorated refund. Docusign indemnifies the customer against third party claims arising from its breach of confidentiality and from intellectual property infringement (9.1). Liability is capped at fees paid for the service in the twelve months before the first event (10.2). The cap does not apply to indemnity obligations, confidentiality breaches, gross negligence or willful misconduct. The AI Attachment narrows these terms for AI. Section 6.2 disclaims all warranties on AI output and says Docusign is not liable for output to the extent it includes customer data. It also removes the indemnity where a claim arises from the customer's data, its own modifications or output it knew to infringe. The agreements do not cover loss from a wrong extraction or redline, and Docusign publishes nothing on insurance.
The August 2025 terms place responsibility for AI results on the user and disclaim accuracy, completeness and suitability. They expressly exclude netLex's liability for decisions, actions and omissions arising from use of AI functionality. Separate provisions also disclaim losses from errors in generated agreements and third party service failures. If netLex is nevertheless held liable, the stated ceiling is the amount the customer paid for the platform during the preceding twelve months. No published AI output indemnity, professional liability insurance commitment or compensation mechanism for a harmful clause is provided. A negotiated software license may contain additional provisions unavailable in these public user terms.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Docusign's Salesforce integration for CLM generates documents and runs workflows across Salesforce Customer 360. With SAP Ariba, users create supplier agreements, ingest third party paper and track workflow tasks from Ariba. The Coupa integration lets contracts be created or updated in either system. Slack carries review notifications and actions, and comments sync between Microsoft Word, Google Docs and CLM. AI-Assisted Review runs inside Word, and Docusign eSignature is built in. The CLM API in the Docusign Developer Center offers object, task and content APIs for Salesforce and custom applications. Docusign Monitor, sold as an extra on top of CLM, reports CLM event activity, including through Splunk. Docusign University runs courses on building custom CLM integrations. The named integrations include no document management system used by law firms, such as iManage or NetDocuments. The product pages do not say which fields move in which direction for each connector.
Salesforce and HubSpot integrations map CRM properties to variables in netLex contract templates. Customer identity, commercial amounts, payment terms, dates and opportunity stage can feed the agreement; the configured stage triggers generation. Contract creation history and the information used remain visible inside the CRM. Legal teams prepare the approved templates and the customer configures the field mapping and trigger. Gupy describes using this process for commercial amendments. netLex also supplies Slack notifications, directory authentication, signature connections and a REST API, with netLex Connect supporting custom input and output flows. Its announced MCP interface still lacks a separate public release confirmation.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Docusign's subprocessor list names CLM's hosting suppliers and places each by where the service is provisioned. The hosts are Equinix in the Netherlands, the United Kingdom and the United States, Switch in the United States, and Microsoft Azure in the United States, Australia, Canada, the European Union and Japan. AI processing is listed separately. Azure AI services for review, summaries and extraction run in the United States, Canada, the European Union, Australia and Japan. Google processing for the CLM Analyzer service runs in Belgium, Canada, Germany, Switzerland, the United Kingdom and the United States. Government editions are separate deployments. The CLM Service Schedule keeps government customer data inside Docusign's FedRAMP Moderate boundary unless a connector exports it (5.2). The DoD Impact Level 4 edition requires a connection to NIPRnet through a boundary cloud access point (5.3). Docusign does not describe the tenancy model for commercial customers and offers no on premises option.
netLex runs on AWS and lets customers choose storage in the United States, Europe or South America. The privacy policy identifies the United States, Ireland and Brazil as contractual locations for storage or processing. It separately permits subcontracting and sharing with providers in other countries, including the United States. A selected repository region therefore does not establish that every AI request stays there. Backups are geographically distributed, without a separate public map of their locations. The native AI integration is with OpenAI, but its processing geography is not tied to each customer region. No customer hosted deployment option is described.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
The certifications page Docusign publishes lists ISO/IEC 27001:2022 certification enterprise wide, ISO/IEC 27017:2015 and 27018:2019, and PCI DSS 4.0. Annual SOC 1 Type II and SOC 2 Type II audits cover all production operations, including data centers. FedRAMP agency authorization, GovRAMP authorization and a Defense Information Systems Agency Impact Level 4 provisional authorization each name CLM directly. Reports and certificates are available in the Docusign Trust Portal, and the annual CSA STAR CAIQ is public on the CSA registry. Docusign also completes the Shared Assessments SIG, S&P Global KY3P and ProcessUnity assessments each year. USDM assesses its 21 CFR Part 11 module annually. C5 Type II covers the eSignature product only and does not extend to CLM.
netLex states that it holds ISO 27001:2022 certification and obtains SOC 2 Type I and Type II reports through recurring audits. The reports are available by request under a nondisclosure agreement. The public security description also specifies annual external penetration testing, static code analysis, component vulnerability analysis and separation of development, test and production environments. Production data are excluded from development and testing. These are more specific assurances than an infrastructure badge alone. However, the public text does not identify the SOC auditor, report observation period or exceptions. AWS's separate certifications should not be treated as independent coverage of every netLex AI function.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The October 2026 subprocessor list assigns AI suppliers to specific CLM features. Azure OpenAI Service handles current AI Assisted Review and agreement summaries, while Azure AI Document Intelligence handles extraction. Google processes CLM Analyzer, and Docusign's DocuSmart subsidiary, trading as Lexion, handles legacy AI Assisted Review for selected United States customers. Countries are specified by service provisioning, and customers can subscribe to updates and object on data protection grounds. Model families and versions are not identified for these CLM services. Gemini naming in the separate Agreement Manager section does not establish that CLM uses the same model or configuration.
OpenAI is identified as the provider behind netLex's native AI drafting and revision features. The privacy policy explains that the integration uses the OpenAI API, and the published supplier list also names OpenAI API and ChatGPT alongside AWS and other service providers. It does not identify a current model version for each agent or specify how those agents route tasks among models. Nor does it map OpenAI processing to the customer's selected storage region. Customers receive notice of privacy policy changes, but a distinct commitment to advance notice of model substitutions is absent. Newer agent features therefore need more detailed supply chain terms.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
A CLM subscription is prepaid and measured by a seat allowance, a document count or both, depending on the edition (4). The Service Schedule for Docusign CLM publishes that charging structure, but Docusign publishes no CLM price. Every call to action on the CLM page, Get Started included, goes to Contact Sales. The site's plans and pricing links lead to eSignature and IAM plans, none of which includes CLM. Under section 4.3, extra seats are charged pro rata at list price for the rest of the term. Documents over the count are charged per document at list price and invoiced monthly in arrears. Seats can be reassigned between people without penalty, and documents exported and then deleted during the term still count. Retrieval after the term ends is a paid professional services engagement. Editions named across Docusign's documents include CLM Essentials, CLM, CLM+ and the AI Extension for CLM, alongside government and DoD Impact Level 4 editions.
The monthly subscription normally depends on the number of users and their access profiles. It includes implementation and automation of an agreed number of documents; additional document automation is priced according to project complexity. Native integrations, including electronic signature connections, are included, while integrations needing special configuration receive a separate project price. This explains the charging structure without publishing a per user rate, minimum contract value or an AI consumption allowance. A quote must distinguish ordinary platform access from any agent entitlement or usage charge. Public materials do not settle renewal increases, termination charges or the total cost of a large migration.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
CLM is sold to legal, sales, procurement, human resources and customer experience teams. Its named customer stories come from wholesale telecom, auto parts distribution, retirement plan administration and recruiting software. Government use runs through CLM Government Products, authorized under FedRAMP and GovRAMP, and a DoD Impact Level 4 edition. Docusign says 2,200 enterprises use CLM for contract management. Its integrations with SAP Ariba and Coupa point at procurement as well as sales contracting. Docusign frames coverage by department and industry rather than by contract type or area of law. It names no minimum customer size, no law firm use, and no contract types the AI handles poorly. The IAM plans page states AI extraction in English, French and German, and the CLM pages give no language list.
netLex serves company legal, sales, procurement, finance and operations teams through contracts, powers of attorney, legal requests and related corporate records. Named customers include Ambev, Blip and Isaac, with Gupy illustrating commercial amendments generated from a CRM. Its templates and playbooks can cover supply agreements, employment contracts, confidentiality agreements and services contracts. The interface is offered in eleven languages and service is available in Portuguese, English and Spanish. Use in more than sixty countries describes geographic adoption, not verified legal coverage in each jurisdiction. The product does not publish an exhaustive set of supported laws, exclusions or a separate law firm matter management offering.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Section 4.1 of the AI Attachment for Docusign Services, version 8 July 2026, grants Docusign a perpetual license to use customer data and AI output to train models and improve its services generally. The data and output are anonymized and aggregated first. The attachment's applicability table says customers on a Master Services Agreement consent to that training for Docusign CLM. Section 4.2 lets the customer opt out at any time with a toggle in the product, on a going forward basis.
Docusign keeps the training data created before the opt out, with no duty to delete it. The AI Trust page describes the same program as consent based. Customers whose subscription began before 8 July 2026 are pointed to earlier versions of the terms.
netLex's privacy policy expressly says that data supplied to its AI functionality will not train the model. It identifies the OpenAI API as the integration used for drafting and reviewing clauses. This is a published policy promise, rather than a separately supplied negotiated AI agreement. The prohibition concerns AI inputs; it does not erase ordinary contract storage, user history or the five year backup period. The policy does not provide model specific audit results or an enforcement mechanism against every underlying provider.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Section 3.1 of the Service Schedule for Docusign CLM, version 15 September 2025, keeps each stored document, including the customer data in it, for the subscription term or until the customer deletes it. The account administrator can set a different retention and deletion schedule. After the term, documents can be retrieved for 90 days through professional services, and Docusign may then delete them (3.2). The schedule covers stored documents rather than prompts as such.
AI output is Customer Confidential Information under the AI Attachment. The same attachment lets Docusign keep anonymized training data derived from content, with no duty to delete it. Docusign does not state what the Azure and Google model services keep from a prompt.
The AI product description says drafting and review data will not be stored, while the general privacy policy retains platform records under a separate schedule. User deletion or contract termination removes user personal data, subject to limited name and email history; backups persist for five years. Customers can request removal of third party personal data from agreements. These provisions distinguish transient AI processing from saved contract content, but do not enumerate provider abuse monitoring exceptions or a separate schedule for agent conversation histories.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
CLM has its own permission model built on folders. A Docusign employee's guide on the Docusign Community sets out six levels. They run from No Access, the default for all content, through View, View and Create, View and Edit, and View, Edit and Delete, to full control with Set Access. Security can be set for a user, a permission profile or a user group. Folders inherit their parent's security unless it is set explicitly.
CLM administrators can see all content whatever the folder settings. The CLM page adds granular permissions controls and an audit trail of who did what and when. Docusign does not say how AI review, summaries or repository lookups apply folder permissions when they run.
netLex describes AI permissions tied to the current user's profile and says agents cannot access data beyond what that person can see. It also describes a separate customer environment, with role permissions and corporate authentication supporting access control. This is a product permission model for corporate contracts, rather than inheritance of a law firm's document management system permissions. The materials do not describe adverse party conflicts, lateral hire screening or an administratively tested ethical wall between separate legal client matters.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 11.2 of the Master Services Agreement, version 14 November 2022, requires prompt written notice before a compelled disclosure of confidential information, unless legal process forbids it. It also requires cooperation in seeking a protective order. The Data Protection Attachment adds prompt notice of any government request about personal data. Docusign's law enforcement page says the company notifies customers when their data is subject to disclosure and withholds notice only under a signed nondisclosure order or a statute that bars it.
The page adds that Docusign cannot decrypt agreement contents at rest. Docusign prepares an annual transparency report on requests and makes it available to data protection authorities on request. The report is not published. Section 2(d) of the CLM Service Schedule says Docusign is not responsible for producing customer documents to any third party.
The privacy policy permits disclosure in situations required by law or judicial decisions. It does not promise advance customer notification of a subpoena, an opportunity to contest the demand or a regular transparency report. A separate notification provision concerns a data subject asking netLex to delete information: the customer is notified so it can instruct the processor. That deletion procedure should not be read as notice of government access. The user terms also allow netLex to report suspected unlawful activity to authorities.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
CLM works from the customer's own contracts, templates and clause library, and does not retrieve case law or legislation. Docusign describes Iris, the engine behind it, as trained on decades of contract data. Section 6.1 of the AI Attachment lists the training data for Docusign's own models as customer data authorized for training, publicly available data and data licensed from third parties. Docusign warrants that to its knowledge it holds sufficient permissions for them.
The section names no specific source or license, and it excludes the data third party providers used for their own models.
The AI features work with customer contracts, attachments, clause playbooks and internal policies. They are not accompanied by an identified collection of licensed case law, statutes or commentary. OpenAI is named as a model provider, but the provider name does not establish the legal sources or licenses behind any generated proposition. Questions about company policy and departures from approved contract wording can have a useful internal reference base. They do not carry a published promise of comprehensive, current legal authority for a jurisdiction.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Docusign CLM manages a customer's own agreements and does not cite case law or legislation, so a citator is not part of the product. The CLM page, the AI-Assisted Review page and the AI Trust page do not address checking authority for later history. Docusign does not describe how CLM detects when an amendment or a policy change leaves extracted terms or clause library positions out of date.
netLex's clause review compares agreements with customer standards and can suggest revised wording. No citator integration, case treatment service or automatic validation of whether a cited decision remains good law is described. Its requirement that users assess AI accuracy before adoption is a general review obligation, not a documented legal authority validation workflow. A team using generated legal opinions would still need an external research source to assess authority, subsequent treatment and relevance to the law governing the contract.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Section 6.2 of the AI Attachment warns that AI output may be incorrect or otherwise undesirable and makes the customer responsible for reviewing it. The AI Trust page describes content filtering for harmful outputs. Neither document says what AI-Assisted Review or the question and answer feature does when a playbook or the repository does not cover what is asked. Nor do they say how a doubtful extraction is marked before it feeds a report, a renewal alert or a workflow rule.
Docusign documents no path for CLM's AI features to decline an answer and publishes no confidence or grounding scores for extraction, review or summaries.
Review Agent flags departures from a configured playbook and explains their severity, while Intake Agent is described as routing complex requests to appropriate people. Neither description specifies when a model declines to answer because support is missing, how uncertainty is communicated or what happens when contract clauses conflict with its assumptions. The terms warn that results can be inaccurate and require human assessment.
They do not supply an abstention policy, confidence calibration or examples of a refusal when legal context is insufficient.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin tracks court decisions worldwide that address hallucinated AI content and records the tool involved where known. It has no entry naming Docusign, Docusign CLM, Iris, SpringCM or Lexion, in the tool field or anywhere in the case text. CLM manages commercial agreements rather than producing court filings, so its output does not ordinarily reach a brief.
The Charlotin collection contained 2,191 cases at this review, with no whole word match for netLex in either the tool field or the full case material. That result is limited to reported incidents included in the collection and does not measure the product's error rate. netLex primarily supports company agreements and internal legal requests, and its terms explicitly acknowledge that AI results may be inaccurate. A lack of a named reported incident does not make a generated legal citation reliable.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Section 6.2 of the AI Attachment for Docusign Services, which governs CLM's AI features, states that neither Docusign, the AI Services nor AI output provide the customer with legal advice. It makes the customer responsible for reviewing output for accuracy and suitability, including through human review. The CLM page, the AI-Assisted Review page, the AI Trust page and the agreements name no bar opinion, ethics rule or professional conduct guidance.
Docusign's compliance work covers data, security and sector regimes, including ISO, SOC, PCI DSS, FedRAMP, GovRAMP, DoD Impact Level 4, HIPAA and 21 CFR Part 11. Those regimes bind Docusign as a provider rather than a lawyer using the product.
The terms require users to evaluate AI output and preserve necessary human legal analysis. netLex also discusses privacy, access permissions and final approval by a legal team. It does not map these arrangements to a named bar association opinion, professional conduct rule or jurisdiction specific guidance on legal AI. Compliance with the LGPD and GDPR concerns data protection and does not establish professional responsibility alignment.
Lawyers remain responsible for applying the conduct rules that govern their practice and the particular use of generated work.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Enterprise legal, sales, procurement, and HR teams use CLM for their employer's agreements. Customer examples include T-Mobile Wholesale, Vestwell, and iCIMS, whose outcomes concern internal contracting speed and administrative effort. Vestwell reduced agreement package creation from 75 minutes to 5 minutes, while iCIMS attributes reduced legal intervention to its workflow. These are corporate operating costs rather than outside counsel invoices, and CLM does not specify a client fee adjustment for AI assisted work.
netLex is sold for a company's own contracting and internal legal operations. The published savings concern productivity, amendment cycle time and business process costs, with subscription charges generally tied to users and their access profiles. Those claims do not describe lawyers charging external clients for time saved by AI. No legal fee allocation, client technology surcharge or invoice narrative is offered. Gupy's measured legal response time is an operational service level within a business, rather than a disclosure of billable legal time.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Docusign's subprocessor list, last updated 18 September 2026, is published as a web page and a download, with a separate section for CLM. It names each hosting supplier and each AI supplier against the feature it powers, with countries and a contact address. Changes go to an RSS feed, with an email route for objections. The Data Protection Attachment, the AI Attachment, the Master Services Agreement and the CLM Service Schedule are all published without a login.
The certifications page and the public CSA STAR CAIQ cover security. Together these documents name every model provider that touches CLM content, and a customer can forward them when its own clients ask about AI vendors.
A published supplier list identifies AWS, OpenAI, Microsoft, Google, Zendesk, signature services and other providers. The privacy policy explains AI input treatment, international transfers, deletion and the five year backup exception. Security reports can be requested under a nondisclosure agreement. These materials give a corporate team information to supply when a client asks about its technology, but do not constitute a named outside counsel approval workflow. The supplier list does not assign locations or detailed processing functions to every listed company.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
CLM keeps an audit trail of who did what and when, and detailed version control across drafts, so the history of a contract can be reconstructed. Docusign does not say whether an AI-Assisted Review suggestion, an AI drafted clause or an AI extraction is marked as machine generated in that history. Nor does it say whether the audit trail records which model produced it. It publishes no export built for disclosing AI involvement and no disclosure template.
CLM output is a contract, a report or an obligation record rather than a court filing. A record of AI involvement would most likely go to a counterparty, an auditor or a regulator.
netLex describes version history, approval tracking and AI interaction logs that distinguish automated actions from human decisions. Its privacy policy provides a REST API route for exporting stored agreements and data when a customer contract ends. The public description does not specify an export joining each prompt, model version, response and lawyer review into a court disclosure record. Contract negotiation history can support internal reconstruction of a drafting decision, but it is not a published filing certificate or a complete account of AI assistance for a court.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
- Refusal and Uncertainty Behavior
Which one fits
Choose Docusign CLM if
- Docusign signatures already anchor the agreement infrastructure.
- The process needs a broad library of configurable workflow steps.
- Enterprise or public sector deployment requirements shape the selection.
Choose netLex if
- Brazilian operations and Portuguese language service are prominent requirements.
- Contracts, powers of attorney and internal requests need a common workspace.
- The team prefers a published prohibition on using AI inputs for model training.
In summary
Docusign CLM
Docusign CLM manages contract generation, clause libraries, negotiation, approval routing and signatures. Iris adds extraction and review, while the product sits alongside other services in Docusign's Intelligent Agreement Management platform.
netLex
netLex uses templates and CRM mappings to start contracts and AI suggestions to revise clauses. Its privacy policy names OpenAI processing, prohibits input training and describes contractual storage choices in Brazil, Ireland or the United States.
Questions buyers ask
What separates Docusign CLM from Agreement Manager for a netLex buyer?
They are separate offerings within the wider Docusign platform. This comparison concerns CLM's generation, negotiation and workflow capabilities, not an assumption that every Agreement Manager feature is included. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Does the Docusign opt out remove material used previously?
The applicable July 2026 AI terms provide a prospective control. They do not promise that opting out removes information already used for prior training, and the customer's contract version matters. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Can netLex guarantee that AI processing remains in Brazil?
Brazil is an available contractual location for storage or processing, but the privacy policy also permits providers in other countries. Selecting the repository region is not a complete AI processing restriction. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
What should a Docusign CLM versus netLex data review focus on?
For the proposed deployment's AI data decision, AI Legal Index identifies the applicable Docusign training permission and opt out mechanics alongside netLex's no training policy and long backup exception. A quote alone does not resolve those terms.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Docusign AI terms can vary with the customer's agreement and effective date. netLex's storage location is subject to the customer's contract and does not map every provider's processing.