Docusign CLM vs Oneflow: how they compare in 2026
Docusign CLM suits an organization standardizing complex agreement processes across departments, with an extensive workflow step library and the wider Docusign agreement environment. Oneflow offers a more immediately defined package for collaborative web contracts, Salesforce data and workspace review, including a published five user Business starting amount. The relevant Docusign product is CLM rather than an ordinary eSignature subscription or Agreement Manager alone. The AI contract terms also lead to different choices. Docusign's July 2026 attachment permits specified deidentified data and output uses with a prospective opt out, whereas Oneflow prohibits model training outright. In those different rights over contract material, AI Legal Index identifies a decision that feature lists cannot resolve. Oneflow nevertheless excludes confidentiality and recourse undertakings for generative AI, and its beta review pricing requires confirmation.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The core of CLM is a workflow and document system. It generates contracts from templates, keeps a clause library, and stores agreements in a repository with reporting. A drag and drop workflow designer offers more than 100 preconfigured steps for generation, review, approval, signature and storage. That system dates from SpringCM, which Docusign agreed to buy in 2018, before generative AI was part of it. AI now drives several core functions. More than 100 pretrained models extract and report on contract data points and legal topics. AI-Assisted Review flags nonstandard clauses and suggests redlines against a playbook. Generative features summarize agreements, draft clauses on request and answer questions about the repository. Docusign brands the engine Iris and describes it as trained on decades of contract data. Workflows can start from analytics, risk scores and contract content, so extracted data drives routing as well as lookups in the repository.
AI supports several substantial contract tasks within Oneflow's wider platform. Write with AI drafts, edits and translates text inside an agreement; AI Extract imports participants, dates and duration into editable metadata. AI Review compares terms with a workspace playbook, and AI Insights aggregates the resulting risks across the portfolio. The premium package adds custom rules, dashboard widgets and a report for negotiation follow up. Electronic signatures, editable HTML agreements, permissions, approvals and renewal reminders continue to work without these models. Customers can disable AI, and several review capabilities remain in beta. AI therefore changes how users analyze contracts without replacing the underlying contract system.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Docusign describes Iris as delivering accurate, secure and trusted agreement intelligence. Its AI Trust page says AI outputs have been tested for accuracy, and that diverse datasets and checks correct skewed outputs before release. Docusign publishes no figure, error rate, test set or evaluation method for CLM extraction, AI-Assisted Review or agreement summaries. The numbers it gives for the review product are time savings, such as 72 to 80 percent saved on contract reviews, with no stated baseline. Section 6.2 of the AI Attachment for Docusign Services, version 8 July 2026, warns that the AI may produce incorrect output, given the probabilistic nature of machine learning. The same section places review for accuracy on the customer. CLM works from the customer's own contracts and clause library rather than from law. Docusign does not describe how a summary or an answer links back to the clause it came from.
Review findings connect to highlighted passages in the agreement, with controls for moving between them. Each finding carries the relevant playbook concept, configured feedback and example clause text. A separate view identifies required clauses that the review did not find, while portfolio charts open the corresponding contract list. This lets the reviewer compare a proposed concern with the actual wording and the organization's rule. Oneflow warns that generated text can misstate facts, numbers and law and recommends human correction. No reproducible accuracy study, error rate or jurisdiction specific evaluation accompanies these features. The contract highlighting supports source verification, not validation of legal authority.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
AI-Assisted Review suggests edits and flags risky language for a reviewer to accept or reject. CLM workflows send agreements with nonstandard terms to review under conditional rules the customer sets, and they can also be triggered automatically by analytics, risk scores and contract content. Every action sits in an audit trail of who did what and when, with version control across drafts. Section 6.2 of the AI Attachment makes the customer responsible for reviewing and evaluating AI output for accuracy and suitability, including through human review. The AI Trust page says the customer has the final say to approve outputs. Docusign does not set out what an AI step may do without a person, at what confidence an extraction is held for review, or what happens after an AI output is found to be wrong.
Administrators enable AI Review for a workspace and configure its playbook, including which clauses matter, which findings count as risks or issues, and what feedback appears. Role permissions separately control access to individual reviews and the Insights dashboard. Sent contracts receive continuing analysis; draft contracts require a manual review action. A person can inspect highlighted text, edit the playbook and use example wording when revising an agreement. The AI appendix advises human review before relying on output. No confidence cutoff, mandatory lawyer approval after an AI finding, or correction route for an already approved mistake is specified. Risk colors classify findings rather than stop execution.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
The CLM page carries four customer stories, each naming the customer, giving figures and quoting a named, titled speaker. T-Mobile Wholesale cut agreement time by 44 percent without adding headcount, with 1.8 times faster cycle time on high value agreements, says Janet Sutherland, Senior Manager of Sales Enablement. Keith McCarraher, Special Projects Manager at the automotive parts distributor, describes more than ten use cases across five departments. Vestwell reports agreement packages built in 5 minutes instead of 75 and 70 percent fewer drop offs, quoted by its COO, Jon Mark. At iCIMS, 78 percent of the company's agreements need no legal involvement, according to Courtney Dutter, Deputy General Counsel. The page also states a 449 percent return on investment, an 85 percent reduction in errors and 2,200 enterprise CLM customers, without naming the study or the customers behind those figures. No story gives a deployment date or a measurement method.
Puzzel's Sales Operations Manager, Anette Johnsen, describes generating offers and contracts from Salesforce opportunities with items from related CPQ quotes. She identifies a concrete benefit of the HTML format: participants revise one agreement instead of uploading successive files before signature. Other named users include Systembolaget's Head of Indirect Sourcing, Tor Myhrman, and Hedin Bil's HR Business Partner, Elin Skoglund, who describe handling agreements and maintaining oversight. These accounts establish operational use across sales, procurement and HR. They do not isolate AI review performance or supply a measured error reduction, evaluation period and sample for Oneflow's current AI packages.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The Docusign Master Services Agreement, version 14 November 2022, keeps Customer Data owned by the customer (3.1). Confidential information may be used only for the purpose given and must be protected with at least reasonable care (11.1). Liability for a breach of confidentiality sits outside the twelve month fee cap (10.2). The AI Attachment treats AI output as Customer Confidential Information. Section 4.1 of the AI Attachment grants Docusign a perpetual license to use CLM customer data and AI output, once anonymized and aggregated, to train models. Section 4.2 lets the customer switch that off going forward with a toggle in the product. Section 4.3 of the MSA separately lets Docusign use deidentified usage data, including for training. Within a customer account, CLM folder security limits who sees which contracts. The agreements and the product pages do not address privilege or work product.
The AI appendix expressly prohibits Oneflow from training any AI model on customer data and takes precedence over conflicting general terms for AI features. Ordinary service confidentiality continues while information remains confidential, with restrictions on compelled disclosure. There is a consequential exception: the generative AI section excludes Oneflow's contractual confidentiality obligations along with liability, indemnities and service levels. Review, Insights and Extract have a separate processing section tied to the DPA. Workspace permissions and optional provider controls support access management, but attorney client privilege and work product receive no specific undertaking. The contract therefore requires attention to the exact AI functionality being enabled.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Section 6.2 of the AI Attachment, the contract that governs CLM's AI features, states that neither Docusign, the AI Services nor AI output provide the customer with legal advice. The same section leaves suitability for any purpose to the customer's sole discretion and has the customer review output for accuracy, including through human review. CLM is sold to sales, procurement, human resources and customer experience teams as well as legal. AI-Assisted Review proposes redlines and drafts clauses for any of those users. Docusign does not say who in a customer reviews an AI redline before it reaches a counterparty, how the product supports a lawyer's competence and supervision duties, or whether any limit applies by jurisdiction.
Oneflow's AI appendix says output is not legal advice, legal conclusions, recommendations about legal rights or an application of law to a customer's circumstances. It advises human review because generated content can misstate law as well as facts. A separate UK article maps solicitor responsibilities to SRA standards, confidentiality, client communication and supervision, and describes practical review and pilot controls. North American terms also prohibit treating the platform as a substitute for an attorney. The product nevertheless serves sales, HR and other users without legal qualifications. No comprehensive jurisdiction by jurisdiction set of product restrictions or lawyer competence program is supplied.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Docusign publishes AI Trust and AI Innovation Principles pages for Iris, the engine behind CLM's AI features. The AI Trust page lists encryption in transit and at rest, consent based training on aggregated and anonymized data, and content filtering for harmful outputs. It also describes diverse datasets and checks that correct skewed outputs before deployment, and adoption of frameworks such as the NIST AI framework. Section 6.1 of the AI Attachment warrants that, to Docusign's knowledge, it holds sufficient permissions for the data used to train its own models. That data is defined as customer data authorized for that use, publicly available data and licensed data. Docusign names no person, committee or team as accountable for model behavior and lists no ISO/IEC 42001 certification. It publishes no test results, including on whether output differs across contract types, languages or regions. The AI Trust page says broader AI Trust capabilities are available through sales.
Oneflow promotes human accountability and warns against automation bias in its guidance for UK legal teams. It recommends evaluating missed issues, overrides and review quality rather than relying only on speed, and says its AI performs best in English and Swedish. These are useful limits and principles for customers designing a pilot. The public material does not identify an accountable AI governance owner, publish a model release evaluation, or report bias and performance differences across languages, contract types or populations. General ISO security controls and a list of security policies concern operational protection; they do not describe a separate AI testing and governance program.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Under section 3.1 of the Service Schedule for Docusign CLM, version 15 September 2025, documents are stored for the subscription term or until the customer deletes them. An account administrator can set a different retention and deletion schedule. Retrieval is free during the term and available for 90 days after it through professional services, after which Docusign may delete the account and its documents (3.2). The Data Protection Attachment, version 4 September 2024, commits to notice of a data breach without undue delay, giving its nature, likely consequences and the measures taken. It also commits to deletion of personal data on request. Docusign's subprocessor list, last updated 18 September 2026, has its own CLM section naming each hosting and AI supplier with locations. Updates go out through an RSS feed, and objections go by email. Agreement contents are encrypted at rest, and folder security controls access inside an account. Section 4.1 of the AI Attachment lets Docusign keep training data derived from customer content after termination, with no duty to delete it. Docusign does not state what Microsoft or Google keep from prompts.
Contract data is encrypted with AES 256 at rest and TLS 1.2 in transit. Customers configure permissions and retention policies; administrators can disable optional providers or AI features. Global DPA terms require breach notification without undue delay, while the North American DPA specifies 48 hours. Daily database snapshots last seven days, and system and authentication logs last 90 days. The DPA permits limited residual backups after deletion without fixing that period. Generative AI history can follow provider terms, while the product page promises removal of temporary review and import data. That leaves no single, specific retention schedule for every prompt and output.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The Master Services Agreement, version 14 November 2022, warrants that the services perform substantially as documented (8.1). The remedy is repair, replacement, or termination and a prorated refund. Docusign indemnifies the customer against third party claims arising from its breach of confidentiality and from intellectual property infringement (9.1). Liability is capped at fees paid for the service in the twelve months before the first event (10.2). The cap does not apply to indemnity obligations, confidentiality breaches, gross negligence or willful misconduct. The AI Attachment narrows these terms for AI. Section 6.2 disclaims all warranties on AI output and says Docusign is not liable for output to the extent it includes customer data. It also removes the indemnity where a claim arises from the customer's data, its own modifications or output it knew to infringe. The agreements do not cover loss from a wrong extraction or redline, and Docusign publishes nothing on insurance.
Ordinary global service terms include an intellectual property defense obligation, a material performance warranty and a general cap based on 12 months of fees. Those protections do not carry through unchanged to AI. The appendix supplies AI output as is, disclaims warranties and excludes all liability and indemnification undertakings for generative AI functionality, together with confidentiality obligations and agreed service levels. It also permits specified AI suspensions or termination without reimbursing fees. North American terms contain the same generative AI exclusion. A wrong clause, inaccurate summary or reliance on generated advice has no specific affirmative AI remedy in these published terms.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Docusign's Salesforce integration for CLM generates documents and runs workflows across Salesforce Customer 360. With SAP Ariba, users create supplier agreements, ingest third party paper and track workflow tasks from Ariba. The Coupa integration lets contracts be created or updated in either system. Slack carries review notifications and actions, and comments sync between Microsoft Word, Google Docs and CLM. AI-Assisted Review runs inside Word, and Docusign eSignature is built in. The CLM API in the Docusign Developer Center offers object, task and content APIs for Salesforce and custom applications. Docusign Monitor, sold as an extra on top of CLM, reports CLM event activity, including through Splunk. Docusign University runs courses on building custom CLM integrations. The named integrations include no document management system used by law firms, such as iManage or NetDocuments. The product pages do not say which fields move in which direction for each connector.
The Salesforce integration creates interactive contracts from opportunities and transfers contact, company and opportunity data into them. Its configurable sync sends data from Salesforce objects into Oneflow and returns contract values to Salesforce. Product tables can reflect price books or CPQ quotes, while workflows map contract stages back to pipeline stages. Engagement events and status changes appear in the Salesforce timeline, and returned contract data supports dashboards. Oneflow identifies separate setup guidance for older and newer integration versions and compatibility with Professional edition upward. HubSpot, Dynamics 365 and other CRM connections complement this workflow; Salesforce and Dynamics can require premium integration charges.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Docusign's subprocessor list names CLM's hosting suppliers and places each by where the service is provisioned. The hosts are Equinix in the Netherlands, the United Kingdom and the United States, Switch in the United States, and Microsoft Azure in the United States, Australia, Canada, the European Union and Japan. AI processing is listed separately. Azure AI services for review, summaries and extraction run in the United States, Canada, the European Union, Australia and Japan. Google processing for the CLM Analyzer service runs in Belgium, Canada, Germany, Switzerland, the United Kingdom and the United States. Government editions are separate deployments. The CLM Service Schedule keeps government customer data inside Docusign's FedRAMP Moderate boundary unless a connector exports it (5.2). The DoD Impact Level 4 edition requires a connection to NIPRnet through a boundary cloud access point (5.3). Docusign does not describe the tenancy model for commercial customers and offers no on premises option.
Production infrastructure uses AWS availability zones in Ireland, with document replication and backups in Sweden. Oneflow's AI FAQ broadly describes data as remaining in the EU, and Insights Premium is described as running within Oneflow's own EU infrastructure. The published subprocessor table gives a more varied picture: optional Legly review operates in Germany, optional OpenAI extraction in the United States, and Postmark email processing also in the United States. Administrators can disable optional services. The public descriptions do not fully reconcile these routes or map every AI function to a processing region. No on premises deployment is offered in the published package descriptions.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
The certifications page Docusign publishes lists ISO/IEC 27001:2022 certification enterprise wide, ISO/IEC 27017:2015 and 27018:2019, and PCI DSS 4.0. Annual SOC 1 Type II and SOC 2 Type II audits cover all production operations, including data centers. FedRAMP agency authorization, GovRAMP authorization and a Defense Information Systems Agency Impact Level 4 provisional authorization each name CLM directly. Reports and certificates are available in the Docusign Trust Portal, and the annual CSA STAR CAIQ is public on the CSA registry. Docusign also completes the Shared Assessments SIG, S&P Global KY3P and ProcessUnity assessments each year. USDM assesses its 21 CFR Part 11 module annually. C5 Type II covers the eSignature product only and does not extend to CLM.
A public certificate issued by Qvalify covers Oneflow AB's digital solution for contract automation under ISO 9001:2015, ISO 14001:2015 and ISO 27001:2022. It was issued on June 28, 2024 and remains valid through June 30, 2027, identifying the Stockholm organization and its registration number. A June 2026 statement of applicability lists the security controls and their implementation status. The security center separately identifies SOC 1 Type 1 and SOC 2 Type 1 reports issued by Grant Thornton, available under NDA. Those reports concern control design; neither is identified as a Type II examination of operating effectiveness over a stated period.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The October 2026 subprocessor list assigns AI suppliers to specific CLM features. Azure OpenAI Service handles current AI Assisted Review and agreement summaries, while Azure AI Document Intelligence handles extraction. Google processes CLM Analyzer, and Docusign's DocuSmart subsidiary, trading as Lexion, handles legacy AI Assisted Review for selected United States customers. Countries are specified by service provisioning, and customers can subscribe to updates and object on data protection grounds. Model families and versions are not identified for these CLM services. Gemini naming in the separate Agreement Manager section does not establish that CLM uses the same model or configuration.
The subprocessor list identifies Legly AB for contract review in Germany and OpenAI for extraction in the United States, alongside AWS infrastructure in Ireland and Sweden. Both AI suppliers are optional and controlled through account settings. The AI appendix directs customers to their Data Management page for the current generative model suppliers and their terms. It does not publish model versions or a complete function to model map. DPA provisions require reasonable advance notice of subprocessor changes to the customer's designated email address and allow a 14 day objection. That process concerns suppliers, without promising notice of every underlying model change.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
A CLM subscription is prepaid and measured by a seat allowance, a document count or both, depending on the edition (4). The Service Schedule for Docusign CLM publishes that charging structure, but Docusign publishes no CLM price. Every call to action on the CLM page, Get Started included, goes to Contact Sales. The site's plans and pricing links lead to eSignature and IAM plans, none of which includes CLM. Under section 4.3, extra seats are charged pro rata at list price for the rest of the term. Documents over the count are charged per document at list price and invoiced monthly in arrears. Seats can be reassigned between people without penalty, and documents exported and then deleted during the term still count. Retrieval after the term ends is a paid professional services engagement. Editions named across Docusign's documents include CLM Essentials, CLM, CLM+ and the AI Extension for CLM, alongside government and DoD Impact Level 4 editions.
Business starts at $292 a month, billed annually, including five users; Enterprise has ten users and a custom quote. Business includes writing, extraction and summary features. Standard AI Review and Insights have conflicting public treatment: the pricing page marks paid beta additions, while September help guidance says they are included in Enterprise during beta. Insights Premium is explicitly a paid addition for Business and Enterprise. SMS, identity verification, premium integrations and enhanced support can cost more. A 14 day trial needs no card. Implementation has no published amount, and global annual renewals can increase by the greater of 5 percent or Swedish CPI.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
CLM is sold to legal, sales, procurement, human resources and customer experience teams. Its named customer stories come from wholesale telecom, auto parts distribution, retirement plan administration and recruiting software. Government use runs through CLM Government Products, authorized under FedRAMP and GovRAMP, and a DoD Impact Level 4 edition. Docusign says 2,200 enterprises use CLM for contract management. Its integrations with SAP Ariba and Coupa point at procurement as well as sales contracting. Docusign frames coverage by department and industry rather than by contract type or area of law. It names no minimum customer size, no law firm use, and no contract types the AI handles poorly. The IAM plans page states AI extraction in English, French and German, and the CLM pages give no language list.
Legal, procurement, sales, finance and HR teams can create and manage agreements in Oneflow. Legal users configure review rules and approve terms; business teams use reusable templates and CRM data for offers, sales agreements and employment documents. Named customers span telecoms, retail, recruitment and public sector purchasing. UK guidance also addresses solicitors using AI for commercial contract review, bringing professional duties into the intended audience. AI is optimized for English and Swedish, with variable results in other languages. The product does not supply a jurisdiction specific research corpus, and its coverage statements do not define supported litigation work or every category of legal agreement.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Section 4.1 of the AI Attachment for Docusign Services, version 8 July 2026, grants Docusign a perpetual license to use customer data and AI output to train models and improve its services generally. The data and output are anonymized and aggregated first. The attachment's applicability table says customers on a Master Services Agreement consent to that training for Docusign CLM. Section 4.2 lets the customer opt out at any time with a toggle in the product, on a going forward basis.
Docusign keeps the training data created before the opt out, with no duty to delete it. The AI Trust page describes the same program as consent based. Customers whose subscription began before 8 July 2026 are pointed to earlier versions of the terms.
The AI appendix forbids Oneflow from using customer data to train any AI models and overrides conflicting general terms for AI issues. Inputs and attributable outputs fall within the customer data definition. The general service license permits improvement and anonymized analysis, and AI feedback may improve accuracy, but those clauses do not remove the express training ban. The product FAQ also says underlying models do not train on customer data.
Separate provider processing, retained history and the generative AI confidentiality exclusion remain relevant to handling client material.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Section 3.1 of the Service Schedule for Docusign CLM, version 15 September 2025, keeps each stored document, including the customer data in it, for the subscription term or until the customer deletes it. The account administrator can set a different retention and deletion schedule. After the term, documents can be retrieved for 90 days through professional services, and Docusign may then delete them (3.2). The schedule covers stored documents rather than prompts as such.
AI output is Customer Confidential Information under the AI Attachment. The same attachment lets Docusign keep anonymized training data derived from content, with no duty to delete it. Docusign does not state what the Azure and Google model services keep from a prompt.
Oneflow permits customers to set retention policies for stored contracts, and its AI page says temporary import, review and Insights data is removed after use. Generative AI has a different contractual provision: input questions and output responses may remain as history under the model supplier's current terms. No uniform period covers that history or every provider copy. Daily database snapshots last seven days, system logs last 90 days, and residual backups after termination have no precise DPA deadline. Contract deletion therefore cannot be treated as an immediate purge of all AI processing records.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
CLM has its own permission model built on folders. A Docusign employee's guide on the Docusign Community sets out six levels. They run from No Access, the default for all content, through View, View and Create, View and Edit, and View, Edit and Delete, to full control with Set Access. Security can be set for a user, a permission profile or a user group. Folders inherit their parent's security unless it is set explicitly.
CLM administrators can see all content whatever the folder settings. The CLM page adds granular permissions controls and an audit trail of who did what and when. Docusign does not say how AI review, summaries or repository lookups apply folder permissions when they run.
Workspace roles control access to contracts, and Oneflow provides distinct permissions for AI Review and the Insights dashboard. Administrators enable review for selected workspaces and can disable AI features or optional suppliers. These controls can support departmental separation and limit who sees review results. The descriptions do not specify how retrieval enforces every contract permission within a workspace, how restrictions propagate to generated summaries, or how a law firm's matter wall follows an AI request. Permission controls alone do not establish a complete ethical wall mechanism for confidential client matters.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 11.2 of the Master Services Agreement, version 14 November 2022, requires prompt written notice before a compelled disclosure of confidential information, unless legal process forbids it. It also requires cooperation in seeking a protective order. The Data Protection Attachment adds prompt notice of any government request about personal data. Docusign's law enforcement page says the company notifies customers when their data is subject to disclosure and withholds notice only under a signed nondisclosure order or a statute that bars it.
The page adds that Docusign cannot decrypt agreement contents at rest. Docusign prepares an annual transparency report on requests and makes it available to data protection authorities on request. The report is not published. Section 2(d) of the CLM Service Schedule says Docusign is not responsible for producing customer documents to any third party.
Global confidentiality terms require reasonable prior notice when disclosure is legally compelled, unless notice is prohibited, and reasonable assistance at the customer's expense in seeking protection. That gives the customer an opportunity to contest or narrow a request involving ordinary confidential service data. The AI appendix expressly removes contractual confidentiality obligations for generative AI functionality, so the same protection should not be assumed across every AI route.
No transparency report accompanies the commitment. North American and global agreements need to be matched to the contracting entity and enabled services.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
CLM works from the customer's own contracts, templates and clause library, and does not retrieve case law or legislation. Docusign describes Iris, the engine behind it, as trained on decades of contract data. Section 6.1 of the AI Attachment lists the training data for Docusign's own models as customer data authorized for training, publicly available data and data licensed from third parties. Docusign warrants that to its knowledge it holds sufficient permissions for them.
The section names no specific source or license, and it excludes the data third party providers used for their own models.
Oneflow's review and portfolio analysis work with the customer's agreements and configured playbook concepts. Example clauses come from the organization's rule setup, and drafting can use selected text as input. No catalog of legislation, reported decisions or licensed legal commentary is supplied for these features. Naming a model provider does not identify the legal sources in its training data or their licensing terms.
The UK educational articles link professional guidance, but those links do not constitute a legal research corpus inside the product.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Docusign CLM manages a customer's own agreements and does not cite case law or legislation, so a citator is not part of the product. The CLM page, the AI-Assisted Review page and the AI Trust page do not address checking authority for later history. Docusign does not describe how CLM detects when an amendment or a policy change leaves extracted terms or clause library positions out of date.
Highlighted review passages let a user inspect contract language, not whether a judicial decision remains authoritative. Oneflow has no published citator connection, treatment history service or automated check of legislation's current status. Teams maintain their own playbooks, including preferred and fallback clauses, so changing a rule after a legal development remains an organizational responsibility. The appendix warns that AI can generate incorrect law and recommends human review. A portfolio risk chart or missing clause flag does not establish that the underlying legal proposition remains valid.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Section 6.2 of the AI Attachment warns that AI output may be incorrect or otherwise undesirable and makes the customer responsible for reviewing it. The AI Trust page describes content filtering for harmful outputs. Neither document says what AI-Assisted Review or the question and answer feature does when a playbook or the repository does not cover what is asked. Nor do they say how a doubtful extraction is marked before it feeds a report, a renewal alert or a workflow rule.
Docusign documents no path for CLM's AI features to decline an answer and publishes no confidence or grounding scores for extraction, review or summaries.
The AI Review interface separates findings from a missing clauses view. That view identifies playbook concepts absent from the agreement, giving the reviewer an explicit negative result instead of merely omitting a match. Red and yellow labels distinguish issues from risks; they are not numerical confidence estimates. Oneflow warns that generated facts and law can be wrong, but does not publish a general abstention rule for drafting or summaries. Missing clause handling is described for review, without promising that every unsupported question will be refused.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin tracks court decisions worldwide that address hallucinated AI content and records the tool involved where known. It has no entry naming Docusign, Docusign CLM, Iris, SpringCM or Lexion, in the tool field or anywhere in the case text. CLM manages commercial agreements rather than producing court filings, so its output does not ordinarily reach a brief.
Damien Charlotin's AI Hallucination Cases database contained no entry naming Oneflow as of October 16, 2026. The result covers the database's reported court incidents, not every private use of the product or every inaccurate contract response. Oneflow itself discusses court examples involving generic AI tools in educational material; those examples do not identify Oneflow as the tool involved. Contract drafting and risk analysis can still produce incorrect law, which the AI appendix expressly warns about. The absence of a named incident provides no accuracy guarantee.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Section 6.2 of the AI Attachment for Docusign Services, which governs CLM's AI features, states that neither Docusign, the AI Services nor AI output provide the customer with legal advice. It makes the customer responsible for reviewing output for accuracy and suitability, including through human review. The CLM page, the AI-Assisted Review page, the AI Trust page and the agreements name no bar opinion, ethics rule or professional conduct guidance.
Docusign's compliance work covers data, security and sector regimes, including ISO, SOC, PCI DSS, FedRAMP, GovRAMP, DoD Impact Level 4, HIPAA and 21 CFR Part 11. Those regimes bind Docusign as a provider rather than a lawyer using the product.
Oneflow's UK contract review guidance maps SRA standards and conduct duties to human supervision, confidentiality, client transparency and practical controls. It also discusses insurance, data protection and the legal team's responsibility for final judgment. This is a jurisdiction specific mapping with suggested review steps, rather than a generic statement that lawyers remain responsible. It is vendor guidance, not regulator approval or an independent finding of compliance. The mapping does not establish equivalent coverage for every jurisdiction in which Oneflow sells its platform.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Enterprise legal, sales, procurement, and HR teams use CLM for their employer's agreements. Customer examples include T-Mobile Wholesale, Vestwell, and iCIMS, whose outcomes concern internal contracting speed and administrative effort. Vestwell reduced agreement package creation from 75 minutes to 5 minutes, while iCIMS attributes reduced legal intervention to its workflow. These are corporate operating costs rather than outside counsel invoices, and CLM does not specify a client fee adjustment for AI assisted work.
The vendor's UK AI review material addresses solicitors as well as internal legal departments and promotes faster review with retained professional judgment. Its product pages also describe reducing routine contract work and administrative effort. No accompanying procedure explains how a firm records AI time, adjusts a client invoice, discloses savings or passes through Oneflow charges. Subscription pricing is the buyer's software cost rather than a client billing policy.
Because the audience includes lawyers serving clients, the time savings claims cannot be treated solely as an organization's internal operating expense.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Docusign's subprocessor list, last updated 18 September 2026, is published as a web page and a download, with a separate section for CLM. It names each hosting supplier and each AI supplier against the feature it powers, with countries and a contact address. Changes go to an RSS feed, with an email route for objections. The Data Protection Attachment, the AI Attachment, the Master Services Agreement and the CLM Service Schedule are all published without a login.
The certifications page and the public CSA STAR CAIQ cover security. Together these documents name every model provider that touches CLM content, and a customer can forward them when its own clients ask about AI vendors.
Oneflow supplies a public DPA, global and North American service terms, an AI appendix and a subprocessor table with functions and processing locations. Optional AI suppliers include Legly and OpenAI, and administrators can control optional services. A public ISO certificate and statement of applicability support security diligence; SOC reports require an NDA. These materials help counsel explain data handling to a client.
They do not form a dedicated client AI disclosure package, and the generative AI confidentiality exclusion and conflicting regional descriptions require specific attention in any outside counsel approval process.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
CLM keeps an audit trail of who did what and when, and detailed version control across drafts, so the history of a contract can be reconstructed. Docusign does not say whether an AI-Assisted Review suggestion, an AI drafted clause or an AI extraction is marked as machine generated in that history. Nor does it say whether the audit trail records which model produced it. It publishes no export built for disclosing AI involvement and no disclosure template.
CLM output is a contract, a report or an obligation record rather than a court filing. A record of AI involvement would most likely go to a counterparty, an auditor or a regulator.
AI Insights supports an export of portfolio analysis, and reviewers can inspect the contract passages associated with a playbook finding. Insights Premium adds an action report for internal discussion and negotiation. Enterprise also includes an account audit log, while signing workflows maintain transaction records. The published export instructions do not establish a complete record of model identity, prompt, output and human edits for each AI action.
These are useful contract administration records, but no court disclosure template or complete model provenance export is described for a later filing.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
Which one fits
Choose Docusign CLM if
- The organization needs extensive configurable agreement process steps.
- Docusign already anchors the wider agreement technology environment.
- Enterprise workflow standardization outweighs a published entry package.
Choose Oneflow if
- A five person rollout benefits from a visible Business starting amount.
- Salesforce CPQ and live agreement editing define the initial project.
- Customer data must be subject to an explicit model training prohibition.
In summary
Docusign CLM
Docusign CLM coordinates agreement workflows with a large library of process steps and connections to business systems. Its AI terms and product entitlements need to be matched to the specific CLM order.
Oneflow
Oneflow combines a negotiated web agreement with playbook findings, signature and renewal handling. CRM object values, CPQ items and contract stages can move between Salesforce and the agreement.
Questions buyers ask
Is a Docusign eSignature plan the same comparison as CLM?
No. CLM supplies the broader contract lifecycle workflow. Docusign's separate eSignature and Agreement Manager offerings do not establish the scope or price of a CLM deployment. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
What does Docusign's AI opt out stop?
Under the July 2026 attachment, it stops specified future training uses rather than reversing learning already performed. Applicable rights depend on the customer's incorporated agreement version and AI services. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Does Oneflow publish a full Enterprise CLM price?
Its Business floor is public, but Enterprise is quoted. Paid AI additions, premium integrations and differences in standard review beta entitlement mean the entry price is not a universal deployment total. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Which data distinction deserves explicit treatment in the order?
For buyers separating future permissions from past training, AI Legal Index contrasts Docusign's prospective opt out with Oneflow's contractual prohibition. That comparison is separate from Oneflow's exclusions affecting confidentiality and remedies for generative AI.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Only Docusign CLM is compared here; separate signature products do not define its enterprise scope.