Harvey vs Lucio: how they compare in 2026
Price and reach set these apart. Harvey is the platform of choice for the largest firms, with more than 3,500 organizations in over 85 countries and more than 80 of the AmLaw 100 among its users. Agents, Vault, Knowledge, Spaces and Command Center cover drafting, bulk review, research, collaboration with other organizations and usage analytics, and storage can stay in the EU or Switzerland, the United States or Australia. Lucio, built by lawyers in Bengaluru, covers research, document review and drafting through one assistant and two add ins, at a published $149 per user a month with no seat minimum. Its Briefcase reads a full case record, chronologies cite each event to the page, and the Outlook add in turns sent email into time entry summaries. Data can stay in India, the UK, the UAE or the United States. Harvey suits a large organization that wants the broadest platform and is ready for a quote. Lucio suits a firm in India or a mid sized firm abroad that wants research, review and drafting in Word and Outlook at a known price.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Agents, Vault review tables, Knowledge research, Contract Intelligence review, Intake triage and Horizon Scanning all produce their output with language models. No document management or workflow system sits underneath that a firm would buy on its own. Vault stores matter documents, and its purpose is extraction, comparison and reporting across them.
Each of the three products is model work. The Assistant answers research questions across case law, statutes and the firm's own files, and it reads a whole Briefcase of documents at once. It builds chronologies with each event tied to its source, compares testimonies and statements, and runs a review mode that looks for weaknesses in a draft argument. In Word, Lucio generates clauses and revisions and compares each clause with the firm's preferred language. In Outlook, it reads threads with their attachments, drafts replies in the lawyer's voice and writes work summaries from sent email for time entries. Prompt libraries, agents tuned to a practice area and fill in templates for regulatory forms sit on top, with Tab to Enhance rewriting a rough prompt into a better one. There is no matter management or billing layer of its own, and documents come from the firm's existing systems.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
In the February 2025 Vals Legal AI Report, a third party benchmark set against a lawyer baseline, Harvey Assistant was tested on six tasks. Its results ranged from 65.0 to 94.8 percent, and it beat the lawyer baseline on five. Document question answering reached 94.8 percent, 24.7 points above the baseline, with responses under a minute. Answers on scanned and badly formatted court transcripts reached 77.8 percent, 24.1 points above it. That study measured task accuracy rather than citation validity, and Harvey did not enter the later Vals study of citation authority. BigLaw Bench, Harvey's own benchmark, publishes its task categories and judging criteria on a public repository, with hallucination and source results by model. It defines a hallucination as a factual claim that a source of truth can disprove and tracks reasoning errors apart. Harvey reports that its systems hallucinate less often than the foundation models on legal tasks while giving longer answers. Every agent claim links to the source passage behind it, and the full BigLaw Bench dataset is available on request.
Every output carries source citations, and answers drawn from uploaded files cite back to the page or line they came from. Research runs over curated repositories for each jurisdiction and, in competition work, over decisions from the EC, the FTC, the CMA, CADE, the CCI and the ACCC, with research mode also querying the web. Where an answer is not in the file, Lucio says so rather than supplying one. The product terms describe output as probabilistic and possibly inaccurate or incomplete. Measured accuracy, a test set and failure analysis are not published, and the case law collections behind research are not named.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Agents show their plan before they run, so a lawyer can adjust the scope and approve the work before Harvey begins. While an agent works, Harvey brings the lawyer back in when a judgment call is needed, logs every step and cites a source for every claim. Intake applies routing rules the legal team defines to send each request to an approved agent, to Contract Intelligence or to a lawyer. Reports and reviews can run on a schedule, and admins govern access through roles and workspace permissions. The point at which an agent stops on its own, and what Harvey commits to when an agent's work is wrong, are not stated.
Edits land in Word as tracked redlines, so the lawyer accepts, rejects or refines each change, and Outlook replies show every AI edit in redline before sending. Lucio describes itself as a research and drafting accelerator in which the lawyer signs the brief and confirms each citation in the record before it reaches a court. Under the product terms, every output must be reviewed and verified by a competent professional before anyone relies on it, and high risk or safety critical use without expert human oversight is prohibited. Agents and prompt libraries are set up per practice by Lucio's legal engineers during onboarding. What the agents may run without a person, any point at which they stop, and what follows a wrong output are not described.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Customer stories name the firm and give figures. Reed Smith, with about 1,800 lawyers in 34 offices, reports 700 Harvey users a day, 1,400 a month and AI certification for every associate. Repsol's legal division started a pilot in January 2024 with 50 lawyers in 12 jurisdictions and reports cutting the time on one process by more than 90%. CMS reports 95% adoption. Other named customers include A&O Shearman, Gleiss Lutz, Cuatrecasas, Macfarlanes, KKR, PwC and Deutsche Telekom. The figures are usage counts and time savings as each customer reports them, with no stated method for how they were measured.
Trilegal, an Indian firm of about 1,200 lawyers, onboarded in 2023 and now has seats across the firm, with its 31 lawyer competition group as the first cohort and partner Gautam Chawla quoted on the rollout. Stubbs Alderton & Markiles, a 45 lawyer technology firm in Southern California, describes Lucio as everyday software, and its CEO reports that a heavy user's billable hours rose after adoption. Becket McGrath of Euclid Law and Kevin Cooper of Hadef & Partners are quoted by name. By its own count, more than 250 law firms and in house teams use the product. It claims about 30 hours saved per lawyer each month and a doubling of productivity, with no method or customer attached to those figures.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Neither Harvey nor its subprocessors may train any AI model on customer content or data, and model providers work under zero data retention. A firm can ask for a bespoke model trained on its own data and used only for that firm. Harvey syncs and enforces the firm's existing ethical wall policies and never creates, modifies or deletes walls, so the walls provider stays the system of record. Workspaces are logically separated, access follows roles, and data is deleted within 30 days of termination. If the law or a court compels disclosure, Harvey gives advance written notice where it is legally permitted. Attorney client privilege and work product are not addressed as such.
Clause 7.4 of the product terms bars using customer data to train or enhance AI models, or for any third party's benefit, unless the user authorizes it. Data is processed only to provide the contracted services, the customer owns its inputs and receives the rights in its outputs, and client data sits in a dedicated tenant encrypted at rest and in transit. Personnel access is limited to privileged users, logged and revoked within 24 hours of a role change. The data processing agreement redirects government requests to the customer and gives notice where the law allows. Privilege and work product are not named, segregation between matters inside a firm is not described, and what the model providers behind the product retain is not stated.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Output is not legal advice and may contain errors, misstatements or gaps, and the Platform Agreement calls the service a research tool. Harvey sells to lawyers, legal departments and professional services firms, and its agent pages leave the judgment on every task with the lawyer. Access credentials belong to one named user and may not be shared. Nothing addresses competence and supervision duties under professional rules, or the jurisdictions where the product may be used.
No legal advice, opinion or recommendation comes from the product, which creates no lawyer client relationship and is no substitute for advice from a professional, as the product terms put it. Customers may be individual practitioners, law firms, chambers or other organizations. Where the product is used in legal practice, the user stays responsible for rules of professional conduct and bar and regulatory requirements. Client confidentiality and the duty of competence also stay with the user, and every output must be verified by a competent professional before reliance. Supervision of junior staff is not addressed, and no jurisdiction is named as outside the product's limits.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
ISO/IEC 42001:2023 certification covers Harvey's AI management system, and the Statement of Applicability published with it sets out the controls in scope. Its AIUC-1 certification, an AI security and safety standard, was conducted by Schellman and, in Harvey's account, validates its adversarial testing and AI security program. The trust center adds IRAP attestation, an EU AI Act item and AI Governance, AI Monitoring and AI Overview documents, with an AI Acceptable Use Policy among its policies. An AI Policy dated 26 December 2025 commits to testing the accuracy, reliability and suitability of the AI in the service and to change management for continuing legal compliance. No accountable owner is named, and nothing is published about uneven output across matter types or populations.
Responsible legal AI is how Lucio describes its aim, and its trust center lists a no use for AI training control, a risk management policy, a secure development lifecycle and an incident response plan among its controls. These are security and data controls rather than AI governance. No governance framework, release testing, accountable owner or finding about uneven output across practice areas, languages or jurisdictions is published. The information security program is reviewed at least once a year and cannot be changed in a way that materially weakens it.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Customers choose what to upload, set their own retention policies and can delete data at any time. Within 30 days of termination, Harvey deletes remaining customer data and content unless told otherwise, and the DPA extends return or deletion to every subprocessor. Access runs on role based controls, logical workspace separation, SAML SSO, audit logs and IP allow listing. The Subprocessor List, updated 21 September 2026, names each provider with its purpose and location, and subscribers receive at least 30 days' notice of an addition with a right to object. Under the Security Addendum, Harvey notifies the customer of a security incident without undue delay and within 48 hours. It then reports the incident's nature, the investigation and the mitigation, and keeps relevant logs for at least a year.
The data processing agreement and the technical and organizational measures are published. Customers can retrieve or delete their data in the product at any time, and Lucio deletes whatever remains on termination or on request, subject to statutory archiving. A personal data breach is notified without undue delay. Subprocessors are kept on the trust center and changed only after at least 30 calendar days' notice, with a right to object and to terminate with a refund. They include OpenRouter, Microsoft Azure, Google Cloud Platform and MongoDB. Access runs on role based controls with multifactor authentication and single sign on. Privileged access is logged and removed within 24 hours of a role change, and staff with that access take role specific training. Cloud snapshots back up customer data, and vulnerability management, static code analysis and a bug bounty are in place.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The Platform Agreement, last updated 9 January 2026, sets out what Harvey stands behind. Section 8 indemnifies the customer against third party claims that the service infringes intellectual property. If a claim arises, Harvey may substitute the service, secure a license to continue, or terminate and refund prepaid fees. The indemnity excludes materials Harvey did not provide and output from input the customer knew was likely to infringe. Harvey warrants that the service conforms to its documentation, is delivered in a professional manner and complies with applicable law. It also commits to carry industry standard insurance with insurers rated A- or better by A.M. Best. Total liability is capped at the greater of 12 months of fees or $250,000. Payment, indemnity and claims the law will not let a contract limit, such as gross negligence, sit outside that cap. Data breach and confidentiality claims carry a separate cap of twice 12 months of fees or $500,000. After a security incident, the Security Addendum commits Harvey to an independent forensic investigation at its own cost. The agreement states that output is AI generated and may contain errors.
Total liability is capped at the subscription fees paid in the 12 months before the claim, and indirect, consequential and punitive damages are excluded for both parties, under product terms governed by Indian law. The products and all output are provided as is, with every warranty disclaimed, including accuracy. The customer indemnifies Lucio, and no indemnity runs from Lucio to the customer. A bespoke master services agreement exists for larger customers but is not public.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Word, Outlook, Teams and SharePoint all run Harvey inside them, and Vault syncs documents from iManage, SharePoint and Google Drive. The iManage connection is a direct OAuth integration with an embedded web extension, and NetDocuments access follows the firm's existing permissions. Intake takes requests from email, Jira, Slack, ServiceNow, iManage, Google Drive and SharePoint and sends updates back to the source channel. Command Center syncs employee profiles through SCIM. Aderant and Ansarada integrations are documented in the trust center, and customers can build their own integrations, including through an MCP connector library. LexisNexis content reaches research through Ask LexisNexis.
Add ins put the product inside Word and Outlook, and connectors reach iManage, NetDocuments, SharePoint, OneDrive and Dropbox, with a short video guide to the NetDocuments connection. In Word, clauses and revisions arrive as tracked changes and playbook comparisons sit beside the document. Fill in templates populate placeholders in filing drafts from the source documents. In Outlook, threads and attachments are read together, and work summaries can be filtered by day, week or matter and copied into a timesheet tool. Single sign on is supported. What each document system connection reads or writes back, and how its permissions carry over, is not described.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Microsoft Azure hosts Harvey's cloud environment, with each customer's data logically separated and access set by role. Customers can keep data in region in the EU or Switzerland, the United States or Australia. Customers with localization needs can also have processing in the EU and Switzerland or in Australia, and that commitment extends to Harvey's subprocessors. The Subprocessor List gives each model provider's processing locations. Where Anthropic or Mistral models are not offered in a chosen region, Harvey reaches them through hosting platforms such as AWS Bedrock and Google Vertex. What changes between plans or tiers is not stated.
Microsoft Azure and Google Cloud host the product, or the customer can run it on infrastructure it deploys itself, with client data in a dedicated tenant. Storage follows the region the customer declares at sign up. Customers in the United Kingdom are stored there, and the same holds for the UAE, the United States and India. EU customers and the rest of the world are stored in the United Kingdom, and without a declaration the default is India. Data may pass through other jurisdictions for transient processing without being retained there, so processing and storage locations are stated separately. One subscription covers every product, so no tier changes these terms.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Schellman audits Harvey for SOC 2 Type II and ISO 27001 every year, and the 2026 audit and certification renewal are complete. The trust center also lists ISO 27701, ISO/IEC 42001, AIUC-1, IRAP, TX-RAMP, GDPR, CCPA and an EU AI Act item. It publishes Statements of Applicability for ISO 27001, 27701 and 42001. Schellman, NCC Group and Bishop Fox perform external audits, and third party penetration tests run every year. Reports, the CAIQ v4.0.3, SIG Core and SIG Lite questionnaires and the data flow and network diagrams are released through a self serve access request, with bulk download.
SOC 2 Type II and ISO 27001:2022 are both held, beside stated compliance with GDPR, UK GDPR, India's DPDP Act, the CCPA and the UAE's data protection law. Controls, policies and reports, including a disaster recovery drill, a vulnerability assessment and static code analysis, sit in a trust center, and documents are released after an access request. Lucio says certifications and reports are available to customers and to their own clients. The auditor and report dates are not shown on the public view.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The Subprocessor List names ten AI providers with their processing locations, among them Microsoft, OpenAI, Google Cloud, Amazon Web Services, Anthropic and Mistral. ElevenLabs supplies voice services, DeepL machine translation, and Baseten and Fireworks.ai further model hosting. Claude and Gemini models run through Amazon Bedrock and Google Vertex AI, as Harvey's subprocessor FAQ explains. Model providers work under zero data retention, with no human review and no training on customer data. Under the DPA, customers who subscribe to the list receive notice at least 30 days before a new subprocessor is added and may object. Which model serves which feature is not stated.
The subprocessor list names OpenRouter in the United States, a router to third party models, beside Microsoft Azure in the United States, the UAE and the United Kingdom and Google Cloud Platform in the United States. The models themselves, and which provider serves which product, are not named. Any new or replacement subprocessor is announced at least 30 calendar days ahead, with a right to object and to leave with a refund of prepaid fees. A change of model behind the same router would not appear on that list. Customer data does not train any model under the product terms.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Fees are set in each customer's order form and invoiced under the Platform Agreement. If an order form is terminated early under the agreement, Harvey refunds a pro rata share of prepaid unused fees. Undisputed late amounts carry a finance charge at the Federal Funds Rate plus 1.5% a year. No rate, plan, tier or unit of charge appears on Harvey's site, and buying starts with a contact sales form.
One subscription covers the Assistant, the Word add in and the Outlook add in at a flat $149 per user a month, with no seat minimum and no fees. Training, onboarding by Lucio's legal engineers, every integration, prompt libraries and templates, and access to current and future legal repositories are included. Use is subject to a fair usage clause that rules out automated or excessive use. Tailored arrangements are handled by email, and larger customers can sign a bespoke master services agreement. The pricing page itself asks visitors to sign up to see the price, and the figure appears in the published answers about cost.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Large law firms, mid sized firms, in house legal departments and professional services firms are the stated buyers. Industry pages cover healthcare and life sciences, technology, energy and utilities, and media, entertainment and telecom. More than 200,000 lawyers at over 3,500 organizations in more than 85 countries use Harvey, including 80% of Am Law 100 firms and five of the Fortune 10. Solutions pages address litigation, transactional work and innovation teams, and research spans legal, regulatory and tax questions across jurisdictions. Firm sizes or practice areas the product is not built for are not stated.
Boutique, mid sized and enterprise law firms and in house legal teams make up the customer base, with users in 13 jurisdictions and data regions for India, the UK, the UAE and the United States. Practice versions cover disputes and litigation, corporate and transactions, banking and regulatory, and competition. Litigation teams get discovery across a Briefcase, chronologies, argument review and testimony comparison, and competition lawyers get curated decisions from six authorities for merger research. Multilingual review and translation serve cross border matters, and OCR reads scanned filings and older documents. Practice areas and jurisdictions outside its range are not stated.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Under the Platform Agreement, Harvey will not train any AI model on customer content or customer data, and its subprocessors will not either. The term covers both uploaded documents, which Harvey calls customer data, and the prompts and answers it calls customer content. A firm that asks for it can have a bespoke model trained on its own data and used only for that firm. Harvey may use usage data, such as feature and session statistics, to develop and improve the service, and usage data excludes customer data and content.
Clause 7.4 of the product terms bars using customer data to train or enhance AI models, or for the benefit of any third party, unless the user explicitly authorizes it. Data is processed only to provide the contracted services, the customer keeps ownership of its inputs and outputs, and no use for AI training appears among the trust center's data controls. The terms separately forbid customers from using Lucio's output to train their own models.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Customers decide what to upload, how long it is kept and whether it can be shared inside the organization, and they can delete data at any time. No default retention period is published. Model providers work under zero data retention, and subprocessors other than cloud storage providers may not retain or log content for human review. After termination, Harvey deletes remaining customer data and content within 30 days unless the customer instructs otherwise.
Customers can retrieve or delete their data in the product at any time, and on termination or request Lucio deletes whatever the customer has not, subject to statutory archiving. Data passing through another region for processing is not retained there. Cloud snapshots back up customer data in the region where it is stored. No fixed retention window and no zero retention setting for prompts and outputs are described.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
NetDocuments permissions carry through, so a user sees only the cabinets, matters, folders and files they can already open, and Harvey does not change those permissions. The iManage connection is a direct OAuth integration that respects iManage permissions and ethical walls. Harvey also syncs the firm's own ethical walls provider and blocks walled users from reaching or sharing restricted content.
Each customer's data sits in a dedicated tenant, is not visible to anyone without the customer's consent, and is governed by role based access control, with any staff access logged. Briefcases group the documents for one case, and Outlook summaries can be filtered by matter. How matters are walled off from one another inside a firm, and whether access follows the permissions in iManage or NetDocuments, is not described.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
If law or a court order compels Harvey to disclose a customer's confidential information, the Platform Agreement commits it to advance written notice where legally permitted and to help seek confidential treatment. The DPA makes the same commitment for law enforcement requests for personal data. Where the law forbids notice, Harvey seeks a waiver and tells the customer once the prohibition ends. Its Law Enforcement Requests policy sends agencies to the customer first, challenges requests its lawyers consider unlawful and answers foreign requests only through channels such as a Mutual Legal Assistance Treaty. No transparency report is published.
Under section 6 of the data processing agreement, Lucio first tries to redirect a government body's binding order to the customer. If it is still compelled to disclose, it notifies the customer promptly where the law allows, so the customer can seek a protective order or another remedy. No transparency report is published, and the clause covers personal data under the agreement.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Knowledge connects questions to legal databases, curated public sources and Harvey's data partners, more than 500 legal sources across jurisdictions. The Subprocessor List names RELX, doing business as LexisNexis, for Ask LexisNexis, and Parallel Web Systems and you.com for web browsing and knowledge sources. Harvey's AI Policy commits it to obtaining the rights and licenses its data sets require. No source list by jurisdiction, license basis per source or update schedule is published.
Research draws on curated repositories for each jurisdiction. For competition work it adds decisions from the European Commission, the FTC, the CMA, CADE, the CCI and the ACCC, which show how regulators treated similar transactions, remedies and market definitions. Research mode can also query the web and the firm's own precedents. The case law collections for each jurisdiction, the rights basis for each source and how often they are updated are not stated.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Knowledge answers from more than 500 legal sources and draws LexisNexis content through Ask LexisNexis. Harvey does not describe a treatment signal or a later history check on the authorities it returns.
Research answers cite the case or statute behind them, and answers about uploaded files cite the page they came from. Lucio describes the lawyer as confirming each citation in the record before it reaches a court. No treatment flag, subsequent history check or link to a citator is described, and the review mode that tests a draft argument surfaces cases against the position rather than their current status.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
BigLaw Bench publishes hallucination rates and explains how Harvey defines and detects hallucinated claims, and agents cite a source for every claim. No setting or behavior is described for declining to answer when Harvey cannot ground a response.
Answers about uploaded documents are grounded in those files and cited to the source line, and where the answer is not in the file the product says so instead of inventing authority or quotes. No published evaluation shows how often this happens, and research answers drawn from the web are not described the same way.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database, maintained by Damien Charlotin, records court decisions worldwide that address hallucinated AI content and names the tool involved where known. It lists one matter naming Harvey, Hill v. Foundation Media LLC (S.D.N.Y., No. 25-cv-5947). On 22 September 2026 the court directed defense counsel to say whether AI was used on a brief with two questioned quotations and a citation, and a week later it took no further action.
Harvey is named only in counsel's own letter to the court, which says the brief was prepared with Harvey. No order makes any finding about Harvey or its output. A Galicia High Court order of 7 July 2026 lists Harvey AI among verified legal AI tools while setting a €1,800 fine, again with no finding about the product. Harvey's agreement states that output is AI generated and may contain errors.
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming Lucio or Zenlegal. Lucio cites every answer to its source and leaves verification before filing to the lawyer.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Harvey's terms call the service a research tool whose output is not legal advice, and the agent pages leave the judgment on each task with the lawyer. No named ethics opinion appears, such as ABA Formal Opinion 512 or a state bar opinion.
Professional conduct rules, bar and regulatory requirements, client confidentiality and the duty of competence stay with the user under the product terms, which say Lucio takes on none of them. No ethics opinion from the bars of India, the United States, the UK or the UAE is discussed, and no mapping of the product to such guidance is published. Lucio's customer stories discuss AI adoption in practice without citing professional rules.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
ROI calculators for law firms and in house teams sit on Harvey's site, and customer stories report time saved, such as Repsol's. Command Center reports adoption by user, practice group and role. Nothing records AI assisted work per matter for billing, or addresses how a firm bills for that work or discloses it to clients.
Sold to law firms, the product is pitched on about 30 hours saved per lawyer each month, more billable work per associate and less non billable preparation time. Its Outlook add in turns sent email and attachments into work summaries that can be filtered by matter and copied into a timesheet tool. Nothing marks which work the AI did, and no guidance on billing or disclosing AI assisted work is published.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
The trust center offers a Data Processing Addendum, a Business Associate Addendum and a Data Subject Requests item. It adds the CAIQ v4.0.3, SIG Core and SIG Lite questionnaires, data flow and network diagrams, a HIPAA report and a Security Welcome Packet. Sensitive items are released through a self serve request with bulk download. Statements of Applicability for ISO 27001, 27701 and 42001 show what each certification covers.
The public Subprocessor List names every provider with its purpose and location, and subscribers hear of additions 30 days ahead.
Subprocessors are listed on the trust center with their countries, including OpenRouter, Microsoft Azure, Google Cloud Platform and MongoDB, and the data processing agreement promises 30 days' notice of any change. Lucio says its certifications and reports can be shared with customers and their own clients through an access request, and a bespoke master services agreement is available for larger firms. No ready client facing disclosure pack is published.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Audit logs are a standard enterprise control, agents log every step, and every claim links to the source passage behind it. Command Center reports usage by user and feature. No export brings together the model used, the sources retrieved and the human review for one document.
Answers cite back to the page, chronologies tie each event to its source document, and Word edits stay visible as tracked changes. Lucio keeps logs of staff access to customer data, and work summaries from Outlook can be grouped by matter. No export records the model used, the sources retrieved and the person who verified a filing, and no court disclosure template is published.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
Which one fits
Choose Harvey if
- You need a platform for thousands of lawyers. Harvey reports more than 200,000 professionals and 3,500 organizations, and Command Center benchmarks adoption across offices.
- You want regulatory change tracked beside legal work. Horizon Scanning tracks and assesses regulatory changes, and Intake routes legal requests from across the business.
- You work with clients or co counsel on shared matters. Spaces gives legal teams in different organizations a secure shared workspace.
Choose Lucio if
- You want to know the price before you buy. Lucio charges a flat monthly fee per user for every product, with integrations and onboarding included and no seat minimum.
- Your work runs through Outlook. The add in reads threads with their attachments, drafts replies with AI edits shown in redline and writes time entry summaries by matter.
- Your data must stay in India or the UAE. Lucio stores customer data in the region declared at sign up, with India, the UK, the UAE and the United States available.
In summary
Harvey
Harvey's platform serves more than 200,000 legal professionals. Its products span purpose built agents, Vault for bulk document analysis, Knowledge for legal, regulatory and tax research, Contract Intelligence, Horizon Scanning for regulatory change and a new Intake module. According to the AI Legal Index, Harvey enforces a firm's existing ethical walls, lets customers set retention policies and holds ISO 42001 for AI management alongside SOC 2 Type II and ISO 27001.
Lucio
Lucio is a legal AI workspace from Bengaluru with three products: an assistant for research, review and drafting, a Word add in for redlining against playbooks, and an Outlook add in for email. According to the AI Legal Index, its product terms bar training AI models on customer data, and its data processing agreement promises notice of government requests where the law allows. It holds SOC 2 Type II and ISO 27001:2022, and more than 250 law firms and in house teams use it.
Questions buyers ask
Is Lucio an Indian alternative to Harvey?
Trade press has described Lucio that way, and the products overlap on research, document review and drafting in Word. Harvey is a broader platform with agents, collaboration spaces and regulatory tracking for large organizations. Lucio packs research, review and drafting into one assistant and two add ins, with Trilegal among its largest users. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
How do Harvey and Lucio price their products?
Harvey does not publish a price and quotes after a demo. Lucio charges a flat fee per user each month for all three products, with no seat minimum and onboarding included. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Where does each store client data?
Harvey stores data in the customer's chosen region, the EU or Switzerland, the United States or Australia, and can also localize processing. Lucio stores data in India, the United Kingdom, the UAE or the United States according to the customer's declared region, and places EU customers in the United Kingdom. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
What happens if a government asks for client data?
Lucio's data processing agreement redirects the request to the customer first and, if disclosure is compelled, notifies the customer where the law allows. Harvey's Law Enforcement Requests policy also sends agencies to the customer first, and its Platform Agreement commits to advance notice of compelled disclosure where the law permits. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Harvey's latest round, announced in 2026, raised $550M. Lucio, the trading name of Zenlegal Technology Private Limited, raised a seed round led by DeVC in 2025, and Artificial Lawyer has called it India's answer to Harvey and Legora. Neither vendor reviewed this page.