GC AI vs Spellbook: how they compare in 2026

Chat answers questions and drafts documents, playbooks run first pass contract reviews, and Contract Intelligence extracts and reconciles terms across a whole portfolio. The Word add in redlines selected clauses or entire agreements, Automations rerun saved instructions on a schedule, and Easy Prompt rewrites a plain request into a detailed legal prompt before it runs. Chats can also draft and send email, build PowerPoint decks and bring earlier conversations back into a new one on request. Requests route across models from Anthropic, OpenAI, Google and xAI, with automatic fallback to another provider when one fails. Complex tasks run through a five step reasoning sequence of scoping, systematic review, pattern tracing, completeness accounting and reconciliation. Cohere's embedding model handles retrieval over uploaded files, and GC AI describes a 20,000 line system prompt tuned for concise, business focused answers. Files, projects, vaults and the skill library hold the material and instructions the models work from. Inside a project, each chat can read the project's files and its sibling chats.

The models are the product. Review, Draft, Ask, Compare and the Associate agent are all generative capabilities delivered through a Word add in that exists to carry them. The company pivoted its whole business to generative AI in 2022, rebranding from Rally to Spellbook. Remove the models and there is no product, only an empty add in.

Answers carry numbered citations that open the source with the quoted passage highlighted, so a lawyer can read the exact text behind each statement. Exact Quote works across uploaded files, web research and the legal databases, and an exported chat can include a citations section listing each quote and its source file. More than 14 million federal and state opinions, supplied by Midpage AI, back the case law answers. Each cited case opens in full in an Opinion Reader, with treatment flags where later history exists. The International Law database links each authority to its official portal, shows how often later decisions cite a case and marks some statutes as in force or not. The Research Agent ranks primary law ahead of secondary sources and uses reference sites such as Wikipedia only for background, never as citations. On GC AI's own In-House Legal Bench of 100 in house tasks, published in May 2026, GC AI passed 86.8% of attorney written criteria, against 79.8% for ChatGPT, 68.4% for Claude and 57.5% for Gemini. Its widest margins came on legal research, regulatory tracking and checklists, and only example tasks and answer keys are released. GC AI tells Word add in users to double check output because hallucinations and errors can occur.

Grounding is real and documented, with the method described, and no figures are published. The vendor states its architecture explicitly. It does not fine tune; it connects general purpose models to proprietary market data and requires them to retrieve and cite rather than rely on learned patterns, reasoning that putting documents into a model's long term memory encourages hallucination. Compare benchmarks a clause against a stated corpus of more than 2,300 contract types and explains why differences matter, and Ask is published as producing answers with citations. The vendor also publishes educational material on hallucination risk for its users. Not located: any accuracy figure, hallucination rate, test set or evaluation for its own product. The CEO has publicly questioned outside benchmarking studies of legal AI tools while the company publishes no measurement of its own.

Agent Connectors split every app action into read tools and write tools. Reads default to Always allow, while writes and deletes default to Needs approval, so GC AI asks before an email goes out or a record changes. A member can set any tool to Always allow, Needs approval or Block, and each approval card offers Approve, Always approve or Deny, with the draft open for editing first. Admins set each connector to Disabled, Read only or Full access for everyone or for named members. Changes inside GC AI follow the same pattern. Creating, renaming, moving or deleting a project appears as a proposal to approve or deny, and files added from chat wait for approval. Contract Intelligence links an amendment to its parent agreement on its own only when the match is high confidence, and offers the rest as suggestions to confirm or dismiss. Any extracted value can be corrected by hand and later reverted to the AI value with its citations. Stakeholder seats give outside counsel and business partners a restricted vault chat. It answers factual questions about shared contracts and sends questions of legal or commercial judgment back to the legal team. Automations run unattended and deliver each result as a new chat for review, and the services agreement requires the customer to make sure users review output.

A real written commitment has the models work alongside a supervising lawyer, with a working review surface and no full control structure. Associate is described as the first AI agent that can work through legal matters across several documents with the user's oversight, which puts the oversight position in the product's own headline claim. The delivery model is itself the review mechanism: output arrives as tracked redlines in a Word document that the lawyer accepts or rejects clause by clause, a concrete control point. Not located: what the agent decides on its own within a matter, the threshold at which it stops, and what happens after an output is wrong.

Eight customer stories name both the company and the lawyer. Tipalti's senior director of corporate legal reports 609 hours saved year to date. Snyk's senior managing counsel says time on core legal tasks fell by half or more, and Interface's head of compliance estimates major tasks take about half the time. Helix's chief privacy officer says productivity doubled, and Jasper's head of commercial legal says tasks that took an hour now take ten minutes. Arc'teryx, Columbia Sportswear and Viant Technology describe how their teams use the product without figures. Viant's chief legal officer, for example, runs HR and privacy questions through GC AI before deciding whether to call outside counsel. Customer logos in the trust center include Vercel, Wayfair, Bass Pro Shops, Eventbrite and Post Holdings. More than 2,100 legal teams in 53 countries use the product by GC AI's count, over 200 of them public companies, and more than 12 million contracts have been reviewed. A December 2025 ROI study of more than 100 active customers reports 14 hours saved per lawyer each week and outside counsel spend down 14%, while GC AI's FAQ puts that cut at 30%. The story figures are the quoted lawyers' own accounts, and an unnamed Fortune 500 technology company is cited as saving 400 hours a month on NDA review.

Real deployment evidence with substance, short of the full A bar. Multiple named customer stories are published with individually attributed detail, including Dropbox with a named associate general counsel on video, Panasonic on saving three weeks building an RFP process, KMSC Law with a named partner, Alturas Capital Partners, Elevare Law and Westaway with a named managing partner. The logo wall names large enterprises including eBay, Fender, Crocs, Franklin Templeton, Hapag Lloyd, Valentino and DirecTV, and the vendor states more than 4,500 legal teams across 80 plus countries. Figures appear but attach loosely: a named partner states Spellbook helps him bill an extra hour a day, and Panasonic's three weeks is a stated saving. Not located: a dated case study carrying figures with a method a reader can assess.

Section 4.9 of the services agreement bars GC AI from using customer data to train generative AI models, and section 5 binds both sides to confidentiality, with notice before any compelled disclosure. Customer data is logically separated from other customers' data, encrypted with AES-256 at rest and TLS 1.2 or higher in transit, and hosted in the United States. Its privilege guidance centers on United States v. Heppner, the February 2026 Southern District of New York ruling that a defendant's exchanges with a consumer AI tool were not privileged. GC AI points out that the court left room for tools used at counsel's direction under enforceable confidentiality terms. It tells lawyers they can treat GC AI like any trusted cloud tool, such as Google Workspace, Slack or Asana. OpenAI, Anthropic, Google, xAI, Cohere and Reducto process customer content on zero retention terms. Claude Fable 5 is the exception, with Anthropic keeping its data for 30 days, and it stays off until an admin enables it. Users delete inputs and outputs whenever they choose, and an organization's full erasure follows a written request.

Substantive published commitments stop short of the full picture. Zero data retention agreements are stated as negotiated with both named model providers, OpenAI and Anthropic, with the mechanism described precisely: customer data in requests and responses is not persisted and exists only in memory to process a request. Encryption, SSO through Microsoft Entra with enforced MFA, and audit controls are stated. Two gaps remain. Attorney client privilege and work product handling are not addressed directly in located material. Segregation between users or matters inside a customer is not documented, so for a product used by firms no walls at matter level are described.

The product is sold to lawyers for in house legal work, and GC AI states that it does not give legal advice; it helps attorneys and their companies deliver advice more efficiently. The services agreement makes the customer responsible for having users review output and for meeting their own legal, regulatory, professional licensing and fiduciary duties. Exact Quote is presented as support for the lawyer's duty to verify sources. GC AI also quotes New York Formal Opinion 2024-5, which says a lawyer must review all generative AI output, citations included, before using it for a client or a tribunal. Lawyers are pointed to their local bar for current rules. Stakeholder seats keep non lawyers to factual questions about shared contracts and send judgment questions to the legal team. GC AI states that it assists with legal work in every jurisdiction, and users set the governing law in each request.

The audience is unambiguous, transactional lawyers at firms and in house teams, with a signup form that asks a prospect to confirm they are a legal professional and offers no path for non lawyers. The vendor publishes educational material engaging with a lawyer's duty of competence and the obligation to verify AI output. What is not published, after checking the site, the solutions pages, the published terms of service and the learning hub on 29 Aug 2026, is a published position on the advice line, on supervision duties as distinct from competence, or on jurisdiction limits, despite the product being sold in more than 80 countries.

The In-House Legal Bench, published in May 2026, is how the company evaluates its own output. Six R&D attorneys wrote 100 in house tasks across ten categories, with answer keys averaging 12 criteria each. An LLM judge marks each criterion pass or fail, and attorneys reviewed a sample of its verdicts by hand. Pass rates are published by category, from 81.6% on summarizing documents to 91.4% on comparison and benchmarking, and GC AI says the results drive product changes. Claude Fable 5 led every other model in GC AI's suite on a benchmark of 100 demanding in house tasks, by GC AI's account. Admins on Team and Enterprise plans can switch off Anthropic, OpenAI or xAI models for the whole organization, and a settings table records who changed each provider and when. An AI Governance and Risk Management Policy sits in the trust center beside the security, conduct and acceptable use policies, shared on request. Who inside GC AI answers for model behavior is not stated.

A published governance document has real substance and outside validation, without testing results or a named owner. The vendor commissioned an independent legal opinion from CMS Law on its classification under the EU AI Act, states that it was assessed as low risk, and makes the full opinion letter downloadable from its trust portal along with the controls implemented for that classification. An outside law firm's classification of the vendor's AI system, published in full, is a governance document rather than a principles page. Not located: a named internal owner of model governance, published results of testing model behavior before release, or any disclosure about uneven output across matter types, parties or populations.

Version 4.0 of the data processing agreement, from June 2026, and an information security addendum set the data rules. GC AI processes personal data only on the customer's instructions. After the term ends it deletes all customer data within 30 days of a written request, at downstream vendors too, and clears backups within 90 days. Users can delete inputs and outputs from the app at any time, and data is kept only while the account is active. The subprocessor list names each provider with its purpose, data types and hosting location, and was last updated 18 September 2026. GC AI emails customers before adding or replacing one, allows 30 days to object, and lets the customer terminate if no solution is agreed within 90 days. A confirmed security incident is reported without undue delay, with cause, mitigation and updates as they become available. Sign in runs through WorkOS with SSO over SAML or OIDC, multifactor authentication and organization roles, and custom roles limit what each member can use. Production code is scanned daily for malware, a third party penetration test runs at least once a year, and backups are encrypted and replicated.

Substantive published policy covers most of the ground, and deletion is the gap. Published and specific: zero data retention at the model layer, with both providers named and the mechanism described; a complete subprocessor list with processing locations in the trust portal; AWS named as primary cloud provider; storage and processing locations stated as Canada and the US; and access control through Microsoft Entra, so a customer enforces its own authentication and MFA policy. Breach notification is addressed through implemented HIPAA Breach Notification rule controls, with signed business associate agreements downloadable, and a vulnerability disclosure policy is published. The security page and FAQ, the terms of service, the privacy policy and the trust portal entry point were searched. They showed no retention period for the vendor's own storage of documents, prompts and outputs, no customer control over that window, and no deletion commitment.

The self serve services agreement, version 10.0 of 24 September 2026, sets the allocation of loss, and customers buying through an order form sign separate terms. Each party's liability is capped at the fees paid or payable for the affected services in the 12 months before the claim, or $100 if that is greater. Indirect and consequential losses are excluded. Gross negligence, willful misconduct and indemnity obligations sit outside the cap. Against third party claims that the service infringes intellectual property, GC AI defends the customer and pays agreed settlements and awarded damages. The indemnity excludes customer data, connected third party apps, modified output, third party web content and misuse. Its remedies run from securing the right to continue, to replacing the technology, to ending access with a refund of prepaid fees. The warranty covers professional, workmanlike service and a platform that materially performs as documented, with correction or a refund as the remedy. The agreement disclaims output, saying AI accuracy can never be guaranteed and that GC AI has no liability for use of or reliance on output. No insurance is stated.

Liability is addressed only through published terms a buyer can read in advance, without a position on the exposure the product creates. Terms of service, a privacy policy and a refund policy are all published openly, and the refund policy is a published commercial commitment. Those documents, the security page and the trust portal entry point, searched, showed no indemnity to the customer for third party claims arising from output, no warranty on output, no stated liability cap figure and no insurance position. The vendor will sign a business associate agreement for protected health information, which is a regulatory undertaking rather than recourse for wrong output.

About 20 apps sit behind Agent Connectors, among them Gmail, Outlook, Google Drive, SharePoint, OneDrive, Dropbox, Slack, Microsoft Teams, Notion, Confluence, HubSpot, Asana, Linear, GitHub and Granola. Legal workflow systems include Ironclad, Agiloft and Checkbox, along with ServiceNow, Jira and the USPTO. Each member connects through OAuth, and GC AI acts only with that member's existing access in the source app. For Microsoft 365, GC AI publishes every delegated Graph permission it requests, from Mail.Send to Sites.ReadWrite.All, with the feature each one serves and why it needs that level. Checkbox, ServiceNow, Google Workspace and the USPTO have their own setup guides covering keys, OAuth apps and admin approval. Contract Intelligence syncs vaults from Google Drive, SharePoint, OneDrive, Dropbox or Ironclad, picking up new files every 15 minutes, with import rules and manual resync. The Word add in installs from AppSource or an XML manifest. A REST API, an MCP server for ChatGPT, Claude and Cursor, and the gcai command line tool expose chats, files, projects, playbooks, skills and vaults, with inference capped at 60 requests a minute per organization. A machine client such as Salesforce Agentforce can reach the MCP server with OAuth client credentials. No connector reaches iManage or NetDocuments.

Real integrations exist and are documented, short of depth. The product is delivered as a Microsoft Word add in and also runs in Google Docs, which is the deepest possible integration into the surface where transactional drafting actually happens rather than a connector alongside it. A dedicated integrations page is published, and the ACM product describes contracts arriving from email, Slack and Salesforce. Authentication integrates with Microsoft Entra. Not located: legal specific document management connectors such as iManage or NetDocuments, and per integration documentation describing what moves in which direction and what an administrator configures.

The service runs on Google Cloud, with Vercel hosting the application and Cloudflare routing traffic. Each organization's data is logically separated, with its own access controls and encryption. Under the data processing agreement, customer personal data is hosted in the United States at all times, and GC AI states that all of its servers are in the United States. Every subprocessor, model providers included, lists the United States as its hosting location. Processing may happen elsewhere. The agreement lets GC AI and its subprocessors process personal data wherever they operate when needed to provide the service, with transfers covered by the Data Privacy Framework or standard contractual clauses. The United States is the only hosting location offered, on every plan.

Deployment model is stated clearly with partial residency detail. The vendor publishes that AWS is the primary cloud provider and that customer data is stored and processed in data centers in Canada and the US, with a full list of subprocessors and their locations in the trust portal. That is a real residency statement naming both jurisdictions. What is missing is customer choice and tenancy: no selectable region, no single tenant or private deployment option, and no statement of the tenancy model is published. For a vendor selling into more than 80 countries, the absence of an EU or UK processing option is a live buyer question the site does not address.

SOC 2 Type II certification, renewed through annual audits, sits alongside a SOC 3 report and a SOC 2 Type I report. GC AI's SafeBase trust center holds the SOC reports, a penetration test summary and policies covering AI governance, acceptable use, anti bribery and conduct. Documents are released through an access request, under a nondisclosure agreement. The information security addendum commits to third party penetration testing of a representative instance at least once a year, vulnerability ranking with CVSS and daily malware scanning of GC AI managed code. Business continuity plans are reviewed each year, and staff with access to customer data are background screened and trained on hire and annually. The reports themselves are released only through that request.

Certification is real and stated with an open route to the evidence, without published scope. SOC 2 Type II and HIPAA are both named, and the badges on the home page link directly to named, dated resources in the trust portal rather than sitting as decorative images. The trust portal is at a stable URL and carries downloadable documents, including business associate agreements and the EU AI Act opinion letter. It works as a self serve request flow rather than a sales gate. Not located: the audit coverage period, the scope or the name of the auditing firm.

Anthropic's Claude family, OpenAI's models, Google's Gemini and xAI's Grok handle chat and analysis. Cohere's embedding model powers retrieval over files, and Reducto parses documents. Requests go to the model best suited to each task and fall back across providers during an outage, and users do not choose a model. Each provider appears on the subprocessor list with zero retention and United States hosting. Claude Fable 5 is the exception, since Anthropic keeps its data for 30 days for safety work, and it stays off until an admin accepts those terms. Admins on Team and Enterprise plans can switch off Anthropic, OpenAI or xAI, with each change logged by person and time, while Gemini cannot be switched off. Before adding or replacing a subprocessor, GC AI emails customers and gives them 30 days to object.

The models underneath are named, their providers identified, where they run is stated, and the commercial terms binding them are disclosed. The vendor names GPT-5 and Claude Opus as the models powering the product on its own home page, and names OpenAI and Anthropic as the providers. It states the zero data retention agreements negotiated with each and what they mean technically, names AWS as the primary cloud provider, states processing locations as Canada and the US, and publishes a complete subprocessor list at a stable trust portal URL. Naming the specific model versions in marketing copy is what a customer inheriting the dependency needs. No explicit commitment to notify customers before the model supply chain changes is published, though the subprocessor list is where such a change would surface.

An individual seat costs $500 a month, billed monthly or yearly by card, and can be bought without a sales call after a 14 day free trial. GC AI says individual pricing is standard and not negotiable. The seat includes unlimited chats and skills, the Word add in, Easy Prompt, analytics on usage and time saved, AI Academy and CLE courses, and the Slack community. Team plans are annual and priced on request, with enterprise SSO, a team skill library, Contract Intelligence, shared chats, solutions attorney support and one legal database. Enterprise pricing is custom. On individual seats, the case law and international law databases are add ons at an unpublished price, each with a one time 30 day trial. API and other usage based features draw on prepaid credits, priced in the platform at purchase and pooled across the organization. Credits expire at the end of the term, usage stops when they run out, and nothing is billed in arrears. Fees are non refundable and renew at the current published price.

Pricing is gated behind a demo request while tier names and feature splits are published, so the shape is visible and the number is not. The pricing page publishes two named tiers, Law Firms and In House Teams, itemizes what each includes, states that pricing is structured around the number of team members on a license, and confirms a 7 day free trial with extended trials available for larger organizations. Free access for academic institutions is published. So a buyer learns the unit of charge and the packaging without a sales call. No figure appears at any tier, and the only route to one is a demo booking.

In house legal departments are the only market, from solo and fractional general counsel on the individual plan to enterprise legal teams. Customers range from startups to Fortune 500 companies across technology, finance, retail and apparel, manufacturing and healthcare, including Hitachi, Vercel, Snyk, Tipalti, Gusto, Arc'teryx, Columbia Sportswear and Wayfair. The named work runs from commercial contracts, NDAs, DPAs and MSAs to privacy, employment, corporate governance, board materials, regulatory research and portfolio contract review. Ready made playbooks cover NDAs, DPAs and MSAs for SaaS and for commercial use. A playbook run can take the deal stage into account when it suggests fallback language, and it works on drafts that carry tracked changes from earlier rounds. Generalist in house lawyers are the best fit, GC AI says, and it will recommend other platforms to specialized practices. Some teams, it notes, keep a traditional research seat for exhaustive litigation research. The legal databases cover United States federal, state and specialized courts and more than 30 jurisdictions in Europe, Asia Pacific and Latin America.

Segment and practice coverage is described with substance, without the boundaries. Two buyer segments have dedicated pages, law firms and in house legal, and six industries have their own: energy, healthcare, financial services, technology, manufacturing, and retail and consumer goods. Firm size is addressed in the trial form, from 1 to 10 through 200 plus, and the vendor states more than 4,500 teams across more than 80 countries. Practice focus is stated clearly and repeatedly as transactional and commercial legal work rather than claimed broadly, which is a real self limit. Litigation appears as an option in the signup form while nothing on the site describes litigation support, and no statement is published of which practice areas or firm sizes the product is not built for.