Docusign CLM vs Pactly: how they compare in 2026
An organization building many approval paths around an established signature service has a different starting point from a small legal department buying its first contract system. Docusign CLM emphasizes configurable lifecycle workflows and enterprise connections. Pactly offers published user plans, Word playbooks and a separate Projects product for portfolio analysis. Across those buying models, AI Legal Index identifies Pactly's standalone analysis package as a way to begin with a defined workload before adopting the wider CLM. Data permissions also deserve a precise comparison: Docusign's July 2026 AI attachment allows anonymized aggregate training with a prospective opt out, while Pactly's terms permit service improvement and anonymized aggregate uses despite its marketing training promise. Pactly's review surfaces let people accept proposed edits and inspect the passages behind extracted answers.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The core of CLM is a workflow and document system. It generates contracts from templates, keeps a clause library, and stores agreements in a repository with reporting. A drag and drop workflow designer offers more than 100 preconfigured steps for generation, review, approval, signature and storage. That system dates from SpringCM, which Docusign agreed to buy in 2018, before generative AI was part of it. AI now drives several core functions. More than 100 pretrained models extract and report on contract data points and legal topics. AI-Assisted Review flags nonstandard clauses and suggests redlines against a playbook. Generative features summarize agreements, draft clauses on request and answer questions about the repository. Docusign brands the engine Iris and describes it as trained on decades of contract data. Workflows can start from analytics, risk scores and contract content, so extracted data drives routing as well as lookups in the repository.
Models identify clauses and concepts for playbook review, generate proposed revisions and extract values across contract collections. Assist adds questions about a contract's text and history, with proposed edits and comments in Word. Projects applies the same questions to many agreements and returns a structured table with reasoning and source passages. These are core analysis functions alongside the conventional platform: questionnaires generate approved templates, workflows route approvals, signatures execute agreements and reminders track renewals. Those administrative features do not depend on generative output. Projects is available separately, while Growth and Ultimate include it within an unspecified fair use allowance.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Docusign describes Iris as delivering accurate, secure and trusted agreement intelligence. Its AI Trust page says AI outputs have been tested for accuracy, and that diverse datasets and checks correct skewed outputs before release. Docusign publishes no figure, error rate, test set or evaluation method for CLM extraction, AI-Assisted Review or agreement summaries. The numbers it gives for the review product are time savings, such as 72 to 80 percent saved on contract reviews, with no stated baseline. Section 6.2 of the AI Attachment for Docusign Services, version 8 July 2026, warns that the AI may produce incorrect output, given the probabilistic nature of machine learning. The same section places review for accuracy on the customer. CLM works from the customer's own contracts and clause library rather than from law. Docusign does not describe how a summary or an answer links back to the clause it came from.
Projects connects an extracted value to reasoning, a quoted source passage and a document view that highlights the relevant text. Users can correct a value, preserve the original AI extraction and mark a result as verified. The guidance names concrete failure modes, including confusion between effective and commencement dates, loss of qualifiers in compound liability caps and missing values in drafts with placeholders. Word review also exposes the clauses behind each playbook assessment. No reproducible benchmark or measured error rate accompanies these mechanisms. The terms expressly warn that AI answers can be incomplete or wrong and require checking against the source.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
AI-Assisted Review suggests edits and flags risky language for a reviewer to accept or reject. CLM workflows send agreements with nonstandard terms to review under conditional rules the customer sets, and they can also be triggered automatically by analytics, risk scores and contract content. Every action sits in an audit trail of who did what and when, with version control across drafts. Section 6.2 of the AI Attachment makes the customer responsible for reviewing and evaluating AI output for accuracy and suitability, including through human review. The AI Trust page says the customer has the final say to approve outputs. Docusign does not set out what an AI step may do without a person, at what confidence an extraction is held for review, or what happens after an AI output is found to be wrong.
Assist never applies a contract edit or comment silently: proposed changes require acceptance and enter Word as tracked changes. A reviewer can reject, revise or copy the proposal, and a support message is not sent without the user's choice. Playbook results can be Uncertain, returning the decision to a human; accepted deviations carry a written justification. Projects preserves corrected and verified values during reruns and identifies outdated results when a column question changes. The external MCP connection is read only and cannot create, modify, delete or send signature requests. Standalone Word generation remains described as an upcoming release rather than an existing unrestricted action.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
The CLM page carries four customer stories, each naming the customer, giving figures and quoting a named, titled speaker. T-Mobile Wholesale cut agreement time by 44 percent without adding headcount, with 1.8 times faster cycle time on high value agreements, says Janet Sutherland, Senior Manager of Sales Enablement. Keith McCarraher, Special Projects Manager at the automotive parts distributor, describes more than ten use cases across five departments. Vestwell reports agreement packages built in 5 minutes instead of 75 and 70 percent fewer drop offs, quoted by its COO, Jon Mark. At iCIMS, 78 percent of the company's agreements need no legal involvement, according to Courtney Dutter, Deputy General Counsel. The page also states a 449 percent return on investment, an 85 percent reduction in errors and 2,200 enterprise CLM customers, without naming the study or the customers behind those figures. No story gives a deployment date or a measurement method.
A September 2022 case study identifies Virtuos and its Senior Legal Counsel, Johnathan Yong, and describes an NDA process before and after adopting Pactly. Requests previously took several days or sometimes a week across Word, shared drives and email. Following template questionnaires, legal review and DocuSign execution, reported median finalization fell to two hours and median completion of a signed agreement to twelve hours. Yong describes feedback more than two months after implementation. The account explains the workflow change and measured contract type, although it does not provide the sample size. It measures contract automation rather than the accuracy of today's generative review features.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The Docusign Master Services Agreement, version 14 November 2022, keeps Customer Data owned by the customer (3.1). Confidential information may be used only for the purpose given and must be protected with at least reasonable care (11.1). Liability for a breach of confidentiality sits outside the twelve month fee cap (10.2). The AI Attachment treats AI output as Customer Confidential Information. Section 4.1 of the AI Attachment grants Docusign a perpetual license to use CLM customer data and AI output, once anonymized and aggregated, to train models. Section 4.2 lets the customer switch that off going forward with a toggle in the product. Section 4.3 of the MSA separately lets Docusign use deidentified usage data, including for training. Within a customer account, CLM folder security limits who sees which contracts. The agreements and the product pages do not address privilege or work product.
The service agreement protects nonpublic customer data as confidential information and preserves customer ownership. Its improvement license nevertheless permits analysis of service information involving customer data during the term and use of anonymized aggregate customer data for lawful business purposes afterward. Public marketing says contracts never train AI models, without the same express restriction in the agreement. Sensitive groups can hide contracts from nonmember administrators, but deliberate sharing and project membership can widen access. The provider list explains where contract data travels. No specific attorney client privilege, work product or accidental disclosure protection is stated for lawyers using these features.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Section 6.2 of the AI Attachment, the contract that governs CLM's AI features, states that neither Docusign, the AI Services nor AI output provide the customer with legal advice. The same section leaves suitability for any purpose to the customer's sole discretion and has the customer review output for accuracy, including through human review. CLM is sold to sales, procurement, human resources and customer experience teams as well as legal. AI-Assisted Review proposes redlines and drafts clauses for any of those users. Docusign does not say who in a customer reviews an AI redline before it reaches a counterparty, how the product supports a lawyer's competence and supervision duties, or whether any limit applies by jurisdiction.
Pactly's agreement says the company is not a law firm, use creates no attorney client relationship and the service does not solicit legal advice. It separately warns that AI answers may be wrong and makes the customer responsible for comparison with the source. Product guidance describes the reviewer accepting edits and resolving uncertain playbook findings, and the company explicitly rejects a fully automatic robot lawyer role. Corporate legal departments are its principal audience, with business users working through forms and approvals. The material does not map the controls to named bar guidance or publish jurisdiction specific professional responsibility limits.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Docusign publishes AI Trust and AI Innovation Principles pages for Iris, the engine behind CLM's AI features. The AI Trust page lists encryption in transit and at rest, consent based training on aggregated and anonymized data, and content filtering for harmful outputs. It also describes diverse datasets and checks that correct skewed outputs before deployment, and adoption of frameworks such as the NIST AI framework. Section 6.1 of the AI Attachment warrants that, to Docusign's knowledge, it holds sufficient permissions for the data used to train its own models. That data is defined as customer data authorized for that use, publicly available data and licensed data. Docusign names no person, committee or team as accountable for model behavior and lists no ISO/IEC 42001 certification. It publishes no test results, including on whether output differs across contract types, languages or regions. The AI Trust page says broader AI Trust capabilities are available through sales.
Published AI guidance explains how customers verify results, handle uncertain findings and correct extraction mistakes. Release notes describe feature changes, and security materials identify a data protection officer and engineering responsibilities for incidents. These do not establish an AI governance program with an accountable model owner, release testing criteria or results on uneven behavior across languages, populations or contract categories. Positive and negative playbook examples help customers configure review, rather than disclose Pactly's own evaluation program. No formal bias assessment, model card or governance framework accompanies the descriptions of Assist, Projects and playbook review.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Under section 3.1 of the Service Schedule for Docusign CLM, version 15 September 2025, documents are stored for the subscription term or until the customer deletes them. An account administrator can set a different retention and deletion schedule. Retrieval is free during the term and available for 90 days after it through professional services, after which Docusign may delete the account and its documents (3.2). The Data Protection Attachment, version 4 September 2024, commits to notice of a data breach without undue delay, giving its nature, likely consequences and the measures taken. It also commits to deletion of personal data on request. Docusign's subprocessor list, last updated 18 September 2026, has its own CLM section naming each hosting and AI supplier with locations. Updates go out through an RSS feed, and objections go by email. Agreement contents are encrypted at rest, and folder security controls access inside an account. Section 4.1 of the AI Attachment lets Docusign keep training data derived from customer content after termination, with no duty to delete it. Docusign does not state what Microsoft or Google keep from prompts.
Pactly describes encrypted storage and transport, monitoring, backups, vulnerability testing and separate production and test environments. Administrators can require two factor authentication, and high criticality incidents trigger notice to affected customers or all customers when the affected group cannot be identified. A public supplier register details processing functions and regions with advance change notice. The terms provide sixty days to retrieve data after termination, followed by requested deletion with an anonymized aggregate exception. Assist attachments expire after seven days, but ordinary chat history, backup deletion and underlying AI provider retention lack a complete fixed schedule. No definite breach notification deadline is stated.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The Master Services Agreement, version 14 November 2022, warrants that the services perform substantially as documented (8.1). The remedy is repair, replacement, or termination and a prorated refund. Docusign indemnifies the customer against third party claims arising from its breach of confidentiality and from intellectual property infringement (9.1). Liability is capped at fees paid for the service in the twelve months before the first event (10.2). The cap does not apply to indemnity obligations, confidentiality breaches, gross negligence or willful misconduct. The AI Attachment narrows these terms for AI. Section 6.2 disclaims all warranties on AI output and says Docusign is not liable for output to the extent it includes customer data. It also removes the indemnity where a claim arises from the customer's data, its own modifications or output it knew to infringe. The agreements do not cover loss from a wrong extraction or redline, and Docusign publishes nothing on insurance.
The service agreement includes an indemnity for third party claims involving patents, copyright or trade secrets infringed by the service, subject to stated exclusions and control of the defense. Available remedies include replacement, modification, a license or termination with unused fees returned. General liability is capped at fees paid in the preceding twelve months and excludes data inaccuracies and several categories of loss. AI answers are expressly described as potentially incomplete or wrong, with verification assigned to the customer. There is no separate output accuracy warranty or AI insurance promise. Availability remedies have separate claim deadlines and exclude beta features.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Docusign's Salesforce integration for CLM generates documents and runs workflows across Salesforce Customer 360. With SAP Ariba, users create supplier agreements, ingest third party paper and track workflow tasks from Ariba. The Coupa integration lets contracts be created or updated in either system. Slack carries review notifications and actions, and comments sync between Microsoft Word, Google Docs and CLM. AI-Assisted Review runs inside Word, and Docusign eSignature is built in. The CLM API in the Docusign Developer Center offers object, task and content APIs for Salesforce and custom applications. Docusign Monitor, sold as an extra on top of CLM, reports CLM event activity, including through Splunk. Docusign University runs courses on building custom CLM integrations. The named integrations include no document management system used by law firms, such as iManage or NetDocuments. The product pages do not say which fields move in which direction for each connector.
The Word plugin uploads an agreement for playbook review, displays matched clauses and proposed fixes, inserts approved language as tracked changes and records review decisions between rounds. The MCP connection exposes eight read only tools for contract text, metadata, parties, playbooks, clauses and account information to external clients such as Claude and Cursor. Public instructions specify API key or OAuth authentication, administrator consent, filters, returned fields and request limits. Separate APIs can generate contracts from templates and support webhooks. DocuSign and Adobe Sign support execution, while the Ultimate plan's SharePoint connection is described as backup only rather than general document synchronization.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Docusign's subprocessor list names CLM's hosting suppliers and places each by where the service is provisioned. The hosts are Equinix in the Netherlands, the United Kingdom and the United States, Switch in the United States, and Microsoft Azure in the United States, Australia, Canada, the European Union and Japan. AI processing is listed separately. Azure AI services for review, summaries and extraction run in the United States, Canada, the European Union, Australia and Japan. Google processing for the CLM Analyzer service runs in Belgium, Canada, Germany, Switzerland, the United Kingdom and the United States. Government editions are separate deployments. The CLM Service Schedule keeps government customer data inside Docusign's FedRAMP Moderate boundary unless a connector exports it (5.2). The DoD Impact Level 4 edition requires a connection to NIPRnet through a boundary cloud access point (5.3). Docusign does not describe the tenancy model for commercial customers and offers no on premises option.
Core hosting, compute and Bedrock inference use AWS in Singapore by default, with Malaysia for specified Malaysian customers. Structured data in MongoDB Atlas remains in Singapore for all customers. The supplier table separately identifies United States processing for document conversion, OCR, Cerebras inference and fallback Anthropic or OpenAI services, plus Langfuse monitoring in Germany and Cloudflare's global edge. Those routes make regional hosting different from exclusive regional processing. The SLA also recognizes fully managed private deployments, without a standard public price for them. Singapore and Malaysia have separate service entry points, and the published provider map identifies functions as well as locations.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
The certifications page Docusign publishes lists ISO/IEC 27001:2022 certification enterprise wide, ISO/IEC 27017:2015 and 27018:2019, and PCI DSS 4.0. Annual SOC 1 Type II and SOC 2 Type II audits cover all production operations, including data centers. FedRAMP agency authorization, GovRAMP authorization and a Defense Information Systems Agency Impact Level 4 provisional authorization each name CLM directly. Reports and certificates are available in the Docusign Trust Portal, and the annual CSA STAR CAIQ is public on the CSA registry. Docusign also completes the Shared Assessments SIG, S&P Global KY3P and ProcessUnity assessments each year. USDM assesses its 21 CFR Part 11 module annually. C5 Type II covers the eSignature product only and does not extend to CLM.
Pactly identifies ISO 27001 certification in its product, pricing and trust materials and offers its certificate, security whitepaper and penetration test results on request. The public trust FAQ describes Amazon's certified data centers when explaining ISO coverage, so infrastructure attestations need to be distinguished from Pactly's own claim. No openly supplied certificate names its current auditor, validity period and exact company scope. SOC, PCI and FISMA references in the infrastructure section concern AWS rather than a separate Pactly audit. Security practices include vulnerability scans, access logging, staff training and incident response, without resolving that certification scope question.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The October 2026 subprocessor list assigns AI suppliers to specific CLM features. Azure OpenAI Service handles current AI Assisted Review and agreement summaries, while Azure AI Document Intelligence handles extraction. Google processes CLM Analyzer, and Docusign's DocuSmart subsidiary, trading as Lexion, handles legacy AI Assisted Review for selected United States customers. Countries are specified by service provisioning, and customers can subscribe to updates and object on data protection grounds. Model families and versions are not identified for these CLM services. Gemini naming in the separate Agreement Manager section does not establish that CLM uses the same model or configuration.
Pactly names AWS Bedrock for core inference, Cerebras for tasks requiring low latency, and Anthropic and OpenAI as fallback providers when Bedrock is unavailable. The supplier register identifies processing locations and also lists Langfuse for AI monitoring. Customers can subscribe to at least thirty days' written notice before a new subprocessor is engaged and raise an objection during that period. Exact production model families and versions are not supplied for each feature, nor is there a promise to notify every model version change within an existing provider. External MCP clients bring their own model relationship in addition to Pactly's built in AI.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
A CLM subscription is prepaid and measured by a seat allowance, a document count or both, depending on the edition (4). The Service Schedule for Docusign CLM publishes that charging structure, but Docusign publishes no CLM price. Every call to action on the CLM page, Get Started included, goes to Contact Sales. The site's plans and pricing links lead to eSignature and IAM plans, none of which includes CLM. Under section 4.3, extra seats are charged pro rata at list price for the rest of the term. Documents over the count are charged per document at list price and invoiced monthly in arrears. Seats can be reassigned between people without penalty, and documents exported and then deleted during the term still count. Retrieval after the term ends is a paid professional services engagement. Editions named across Docusign's documents include CLM Essentials, CLM, CLM+ and the AI Extension for CLM, alongside government and DoD Impact Level 4 editions.
Standalone Projects starts at $69 a month for one user, fifty documents and 250 monthly runs, or $690 annually with 3,000 runs available immediately. Larger packages, additional documents and extra runs have published charges. The wider CLM starts at $99 per user monthly on an annual plan; Growth is $139 with five users minimum and Ultimate $179 with ten. Their monthly AI review allowances are ten, fifty and one hundred respectively. Growth and Ultimate include Projects under fair use without a numerical allowance. Enterprise, migration and some implementation services require a quote. Projects has a fourteen day trial, while the CLM trial lasts thirty days.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
CLM is sold to legal, sales, procurement, human resources and customer experience teams. Its named customer stories come from wholesale telecom, auto parts distribution, retirement plan administration and recruiting software. Government use runs through CLM Government Products, authorized under FedRAMP and GovRAMP, and a DoD Impact Level 4 edition. Docusign says 2,200 enterprises use CLM for contract management. Its integrations with SAP Ariba and Coupa point at procurement as well as sales contracting. Docusign frames coverage by department and industry rather than by contract type or area of law. It names no minimum customer size, no law firm use, and no contract types the AI handles poorly. The IAM plans page states AI extraction in English, French and German, and the CLM pages give no language list.
Pactly primarily serves corporate legal departments, including solo counsel and small teams across Southeast Asia and other Asia Pacific markets. Larger organizations can configure approval routes, business intake and administrator controls. Supported examples include NDAs, services, procurement, leases, employment and software licenses; Projects extends analysis to loan agreements, insurance and related portfolios. Sales, HR, finance and procurement can participate without turning the product into a consumer legal advice service. The company explicitly describes most customers as internal legal departments rather than firms. No measured language coverage or comprehensive jurisdiction matrix defines where AI interpretation is most reliable.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Section 4.1 of the AI Attachment for Docusign Services, version 8 July 2026, grants Docusign a perpetual license to use customer data and AI output to train models and improve its services generally. The data and output are anonymized and aggregated first. The attachment's applicability table says customers on a Master Services Agreement consent to that training for Docusign CLM. Section 4.2 lets the customer opt out at any time with a toggle in the product, on a going forward basis.
Docusign keeps the training data created before the opt out, with no duty to delete it. The AI Trust page describes the same program as consent based. Customers whose subscription began before 8 July 2026 are pointed to earlier versions of the terms.
The agreement permits analysis of service information involving customer data during the subscription for improvement and development. It also allows anonymized customer data to enter aggregate datasets used for lawful business purposes during and after the term, with safeguards against reidentification. Marketing separately promises that contracts never train AI models. The published agreement does not repeat that prohibition or exclude model improvement from its permission.
This records the contractual scope, not a claim that Pactly actually feeds every raw agreement into a shared training process.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Section 3.1 of the Service Schedule for Docusign CLM, version 15 September 2025, keeps each stored document, including the customer data in it, for the subscription term or until the customer deletes it. The account administrator can set a different retention and deletion schedule. After the term, documents can be retrieved for 90 days through professional services, and Docusign may then delete them (3.2). The schedule covers stored documents rather than prompts as such.
AI output is Customer Confidential Information under the AI Attachment. The same attachment lets Docusign keep anonymized training data derived from content, with no duty to delete it. Docusign does not state what the Azure and Google model services keep from a prompt.
Contract data remains retrievable for sixty days after termination. The standard terms then provide deletion on written request, excluding anonymized data already combined into aggregate datasets; online plans may delete after the same access window. Assist attachments expire after seven days, but a complete schedule for normal chat history, backups and provider copies is absent. The upcoming standalone Word generation description gives a thirty day file expiry, which should not be treated as the lifetime of all current AI outputs or contracts saved to the repository.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
CLM has its own permission model built on folders. A Docusign employee's guide on the Docusign Community sets out six levels. They run from No Access, the default for all content, through View, View and Create, View and Edit, and View, Edit and Delete, to full control with Set Access. Security can be set for a user, a permission profile or a user group. Folders inherit their parent's security unless it is set explicitly.
CLM administrators can see all content whatever the folder settings. The CLM page adds granular permissions controls and an audit trail of who did what and when. Docusign does not say how AI review, summaries or repository lookups apply folder permissions when they run.
Pactly uses its own groups and roles rather than inheriting a document management system's matter walls. Sensitive groups hide contracts even from nonmember administrators, but an authorized person can deliberately share a contract outside the group. Projects creates another boundary: every project member sees all present and future project documents, even when the normal repository link is unavailable. Administrators can see all projects.
This is a described access model with important widening rules, not a promise that an original contract restriction automatically follows every AI analysis surface.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 11.2 of the Master Services Agreement, version 14 November 2022, requires prompt written notice before a compelled disclosure of confidential information, unless legal process forbids it. It also requires cooperation in seeking a protective order. The Data Protection Attachment adds prompt notice of any government request about personal data. Docusign's law enforcement page says the company notifies customers when their data is subject to disclosure and withholds notice only under a signed nondisclosure order or a statute that bars it.
The page adds that Docusign cannot decrypt agreement contents at rest. Docusign prepares an annual transparency report on requests and makes it available to data protection authorities on request. The report is not published. Section 2(d) of the CLM Service Schedule says Docusign is not responsible for producing customer documents to any third party.
The service agreement incorporates Pactly's law enforcement request policy for compelled disclosure of customer data. That policy requires evaluation of governmental requests and notification to the customer where legally permitted, allowing an opportunity to seek protective measures. It applies to hosted and fully managed deployments, while excluding self hosted or customer managed solutions. Foreign authorities are directed through applicable legal and diplomatic channels.
No report of request volumes or outcomes accompanies this commitment, and the general privacy notice's legal disclosure permissions do not replace the more specific customer data policy.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
CLM works from the customer's own contracts, templates and clause library, and does not retrieve case law or legislation. Docusign describes Iris, the engine behind it, as trained on decades of contract data. Section 6.1 of the AI Attachment lists the training data for Docusign's own models as customer data authorized for training, publicly available data and data licensed from third parties. Docusign warrants that to its knowledge it holds sufficient permissions for them.
The section names no specific source or license, and it excludes the data third party providers used for their own models.
The analysis context is the customer's agreements, playbooks, approved clauses and related files. Projects reads each row's main contract and supporting amendments or schedules; Word review uses configured positions and fallback language. These are customer supplied materials rather than a catalog of primary law or licensed legal commentary. Pactly does not name an external research corpus, describe the source rights behind general model knowledge or supply an update process for legislation and case law. The public subprocessor list identifies processing suppliers, not a legal content licensing arrangement.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Docusign CLM manages a customer's own agreements and does not cite case law or legislation, so a citator is not part of the product. The CLM page, the AI-Assisted Review page and the AI Trust page do not address checking authority for later history. Docusign does not describe how CLM detects when an amendment or a policy change leaves extracted terms or clause library positions out of date.
A source passage in Projects establishes where a contract value came from, and playbook review identifies the agreement language relevant to a configured rule. Neither function determines whether a case remains good law or legislation has changed. No licensed citator, subsequent history service or independent treatment signal is described. The legal team maintains its own clause positions and decides whether they remain appropriate.
Contract source highlighting and a verified cell marker therefore support review of supplied material without establishing the continuing validity of an external legal proposition.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
Section 6.2 of the AI Attachment warns that AI output may be incorrect or otherwise undesirable and makes the customer responsible for reviewing it. The AI Trust page describes content filtering for harmful outputs. Neither document says what AI-Assisted Review or the question and answer feature does when a playbook or the repository does not cover what is asked. Nor do they say how a doubtful extraction is marked before it feeds a report, a renewal alert or a workflow rule.
Docusign documents no path for CLM's AI features to decline an answer and publishes no confidence or grounding scores for extraction, review or summaries.
Playbook review includes an Uncertain result when a clause cannot be conclusively assessed, directing a person to decide. Each position also defines what happens when no relevant clause is found: compliant, not compliant or uncertain, according to the customer's chosen rule. Projects treats placeholders such as an unfilled name as not found and explains common interpretation failures. These are described negative and uncertainty states rather than a general guarantee of refusal. A wrong configuration of the absent clause rule can still produce a misleading result.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin tracks court decisions worldwide that address hallucinated AI content and records the tool involved where known. It has no entry naming Docusign, Docusign CLM, Iris, SpringCM or Lexion, in the tool field or anywhere in the case text. CLM manages commercial agreements rather than producing court filings, so its output does not ordinarily reach a brief.
Damien Charlotin's AI Hallucination Cases database contained no entry naming Pactly on October 16, 2026. The database concerns reported court decisions involving fabricated AI material and does not capture every private error in contract analysis. Pactly principally supports corporate agreements rather than preparation of court authorities, which limits what that incident record can say about its usual work. Its terms independently warn that AI answers may be incomplete or incorrect. No named court incident is therefore a limited reporting observation, not a validation of model accuracy.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Section 6.2 of the AI Attachment for Docusign Services, which governs CLM's AI features, states that neither Docusign, the AI Services nor AI output provide the customer with legal advice. It makes the customer responsible for reviewing output for accuracy and suitability, including through human review. The CLM page, the AI-Assisted Review page, the AI Trust page and the agreements name no bar opinion, ethics rule or professional conduct guidance.
Docusign's compliance work covers data, security and sector regimes, including ISO, SOC, PCI DSS, FedRAMP, GovRAMP, DoD Impact Level 4, HIPAA and 21 CFR Part 11. Those regimes bind Docusign as a provider rather than a lawyer using the product.
Pactly explains that it is not a law firm and requires people to verify AI answers against source text. Its review guidance describes accepting tracked edits, recording deviations and resolving uncertain results. These are practical controls for legal work, but the materials do not map them to a named professional ethics opinion, bar rule or regulator's jurisdiction specific AI guidance. References to Singapore privacy law and a data protection officer address data regulation rather than a lawyer's professional obligations when serving a client.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Enterprise legal, sales, procurement, and HR teams use CLM for their employer's agreements. Customer examples include T-Mobile Wholesale, Vestwell, and iCIMS, whose outcomes concern internal contracting speed and administrative effort. Vestwell reduced agreement package creation from 75 minutes to 5 minutes, while iCIMS attributes reduced legal intervention to its workflow. These are corporate operating costs rather than outside counsel invoices, and CLM does not specify a client fee adjustment for AI assisted work.
The principal buyer is a company's own legal department, with sales, procurement and HR using forms and approvals around that team's contracts. The Virtuos case measures internal NDA turnaround, and the product's savings claims concern corporate workloads and staffing capacity. Those examples do not involve a lawyer billing an external client for AI assisted work. Published subscription and run charges describe Pactly's software fees, without a client invoice method, pass through rule or accounting of billable legal time. Law firm fee treatment is not part of the described workflow.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Docusign's subprocessor list, last updated 18 September 2026, is published as a web page and a download, with a separate section for CLM. It names each hosting supplier and each AI supplier against the feature it powers, with countries and a contact address. Changes go to an RSS feed, with an email route for objections. The Data Protection Attachment, the AI Attachment, the Master Services Agreement and the CLM Service Schedule are all published without a login.
The certifications page and the public CSA STAR CAIQ cover security. Together these documents name every model provider that touches CLM content, and a customer can forward them when its own clients ask about AI vendors.
A public provider register identifies data categories, functions and regions, including core Bedrock inference, fallback Anthropic and OpenAI services, and AI monitoring. Customers can subscribe to change notices and object before a new supplier is engaged. The trust page offers security reports and a certificate on request, while service terms and the law enforcement policy provide additional diligence material. No dedicated client consent pack or outside counsel AI disclosure form is supplied. Counsel would still need to distinguish the contractual improvement permissions from the marketing training promise.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
CLM keeps an audit trail of who did what and when, and detailed version control across drafts, so the history of a contract can be reconstructed. Docusign does not say whether an AI-Assisted Review suggestion, an AI drafted clause or an AI extraction is marked as machine generated in that history. Nor does it say whether the audit trail records which model produced it. It publishes no export built for disclosing AI involvement and no disclosure template.
CLM output is a contract, a report or an obligation record rather than a court filing. A record of AI involvement would most likely go to a counterparty, an auditor or a regulator.
Projects can export values, reasoning and source references to Excel, and produce a PDF preserving the table's visual labels. Human corrections and verifications record who acted and when inside the application, but the help guide expressly says the Excel export omits that sign off marker. Word review retains tracked edits and written justifications for deviations, while account activity is available through logs. These records preserve parts of the process without a combined export of model version, exact prompts, source context and human approval for a court filing.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
Which one fits
Choose Docusign CLM if
- Your project centers on configurable enterprise contract workflows.
- The organization already uses Docusign for agreement execution.
- Contract generation, approvals and connected systems need a shared process.
Choose Pactly if
- A small legal team needs a stated starting user price.
- You want portfolio analysis without buying the full contract workflow.
- Reviewers need source excerpts and protected corrections in analysis cells.
In summary
Docusign CLM
Docusign CLM organizes agreement generation, approvals, negotiation and signature through configurable enterprise workflows. Its AI capabilities sit within a wider agreement platform with contract and attachment terms that vary by enabled service.
Pactly
Pactly combines Word review and contract routing with Projects, an independently priced table for portfolio questions. Human acceptance governs Assist edits, and verified analysis values survive subsequent reruns.
Questions buyers ask
Is Pactly Projects the same subscription as its CLM?
No. Projects has its own document and run allowances. Pactly's CLM begins at $99 per user monthly on an annual plan, with larger tiers adding workflow, review and integration capacity. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Do the two services make identical training commitments?
No. Docusign's July 2026 AI attachment permits anonymized aggregate training with prospective opt out rights. Pactly's service agreement permits improvement and anonymized aggregate uses without an express model training exclusion. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Can an opt out remove data already used by Docusign?
The attachment's opt out is prospective, and earlier trained versions can remain. The particular attachment and product enabled in a customer's agreement determine how that provision applies. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
What makes Pactly's analysis useful before a wider CLM rollout?
For a defined portfolio review project, AI Legal Index highlights Pactly's separate run allowances and reusable question columns. Reviewers can inspect reasoning and source excerpts, correct values and preserve those corrections on reruns.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Docusign AI attachment versions and enabled services matter; Pactly's Projects price does not include its complete CLM.