Icertis vs Ironclad: how they compare in 2026

MEMBERSHIP: the AI bar is cleared. The brief flagged this vendor for a check on whether the AI is real, and it is: Icertis Copilots, a contract intelligence engine extracting clauses, obligations and risk, and a Vera agent layer shipped across Engage, Operate and Analyze in 2026, with the vendor stating agents act autonomously within boundaries the customer sets. That is shipped capability rather than an AI roadmap. GRADE: the models are the engine of a core capability layered on a product that would function without them. The platform covers authoring, negotiation, approval, execution, obligation management and analytics, and it existed and sold as Icertis Contract Management before the AI positioning; the rename to Contract Intelligence marks the layer being added rather than the product being rebuilt. Third B in a row on this axis, and the first of the four flagged legacy platform names to be tested.

The models are the engine of a core capability, layered on a product that would function without them as a workflow system. Ironclad is a contract lifecycle management platform: intake, no code Workflow Designer, approvals, routing, signature, repository, analytics and integrations all predate and stand without generative AI, and the vendor sells that workflow layer as its foundation. What the models drive is real and central rather than peripheral, which is why this is not a C: AI Playbooks with each play tied to a clause do the redlining, and Jurist runs a named family of agents for drafting, editing, review, research, intake and redlining under a Manager Agent, with Conversational Search over the repository. Second B on this axis after Definely, and for the same structural reason: an established product with a substantial AI layer rather than an AI native one.

Accuracy is asserted without measurement and without a described grounding method. Vendor material describes a contract intelligence engine that extracts clauses, obligations and risk and turns them into queryable data, and an enterprise wide intelligence layer that understands business and industry context, all of which is capability description rather than accuracy evidence. Searched the vendor site, the research and blog sections, the platform pages and the published State of Contracting material on 29 Aug 2026 and located no accuracy figure, no hallucination rate, no test set, no evaluation and no description of how output grounds to a source the reader can open. Worth recording alongside this, from a third party source rather than the vendor: a Gartner Peer Insights reviewer states their organisation has not been impressed with the Discovery tool AI. That is a single unverified customer view, is not treated as evidence for the grade, and is noted only because this axis exists to weigh published accuracy claims against what buyers can check.

Accuracy is asserted and the grounding behind it is not documented. Vendor material claims precision redlining, advanced AI and proprietary legal AI models trained on legal terminology with legal engineered prompts. Real structure exists in the AI Playbooks mechanism, where each play is tied to a clause and the system proposes varying degrees of revision to match preferred terms with minimal language change, so output is anchored to a customer authored standard a reviewer can check. What is missing is everything this axis measures: searched the site, the Ironclad AI and Jurist product pages, the security page and the support documentation via search on 29 Aug 2026 and located no accuracy figure, no hallucination rate, no test set, no evaluation, and no description of the retrieval method or how output grounds to a source a reader can open.

A real published commitment with a stated control concept, short of the mechanism. The vendor's own framing is specific and unusually well chosen: agents act autonomously within boundaries you set, so you can move fast and safely, and the platform is described as human first alongside AI native. That states both that the system acts alone and that the customer defines the limit, which is more than an assertion of human in the loop. The vendor's own published research reports that 44 percent of contracting leaders lack sufficient trust in AI's autonomous capabilities, so it is engaging with the question rather than avoiding it. Not located as of 29 Aug 2026: how a boundary is configured, what an agent does when it reaches one, what review surface a human gets, and what the vendor commits to when an output is wrong.

A written commitment that the models work alongside a supervising human, with real and specific review surfaces, short of published thresholds. The vendor states human in the loop governance ensures every agent works transparently, is auditable and controllable, and says plainly that the customer is in charge, with governed and auditable AI review frameworks the customer can review, override and continuously govern across teams and contract types. The control surface is administrative as well as rhetorical: playbook permissions let administrators configure which users and groups may view, create and edit playbooks, and a Manager Agent routes tasks across the agent family so orchestration is visible. Vendor material states the agents automate repetitive lower risk work while strategic negotiation and nuanced risk assessment stay with the lawyer, which is a stated allocation. Not located as of 29 Aug 2026: the threshold at which an agent stops or escalates, and what the vendor commits to when an output is wrong.

Unattributed testimonials and scale claims stand in for deployment evidence. Customer quotes are published but the customers are anonymised by revenue band rather than named, including an IT services customer with more than $30 billion in annual revenue and a healthcare and biotech customer with more than $1 billion. Scale is claimed at 30 percent of the Fortune 100 across 90 plus countries and millions of contracts. Third party recognition is real and quantified: named a Customers' Choice vendor in the 2025 Gartner Peer Insights Voice of the Customer report for CLM, with 93 percent of customers recommending the platform across 84 ratings. That is measured satisfaction rather than a deployment outcome. Searched the vendor site, the customer and research sections and the news index on 29 Aug 2026 and located no named customer paired with figures, a date and an assessable method.

Real deployment evidence with substance, short of dated attribution and method. A named customer carries a figure: NEXT Insurance is published as giving legal operations 50 percent of its time back with Jurist. Attributed customer quotes carry before and after numbers, including a first pass redline moving from 30 minutes to a couple of hours down to a solid first draft in minutes, and an MNDA review or custom order form clause drafting moving from an hour to a day down to minutes or seconds. A customer stories section is published. Not located as of 29 Aug 2026: a dated case study with a stated method a reader could assess, and the identity of the speakers behind several of the quoted figures.

Confidentiality is asserted in general terms and the current documentation was not reachable. The clearest located statement of data handling is that the platform stores agreements on a GDPR compliant cloud infrastructure with all data encrypted at rest and in transit under a permission based management approach, which appears in a company news item from 2017. That the most specific confidentiality statement locatable dates from nearly a decade ago is itself the finding. Searched the vendor site, the platform and company sections, the news index and three separate targeted searches for a trust centre or security page on 29 Aug 2026 without reaching one. Not located: any statement on whether customer content may be used to train models, any treatment of attorney client privilege or work product, any segregation model between customers or users, and any retention or deletion terms. See the build log note on this record's evidence floor.

Substantive published commitments, and unusually the vendor addresses its own training use directly rather than only its providers. Published: strict do not train and zero data retention policies enforced with external LLM providers; any customer data used to train Ironclad's own models is anonymised and aggregated before use; output generated for other customers by models trained on a customer's data will never include that customer's data; and training data protection is stated as covered by the same security standards as the rest of the platform. Certification covers the privacy trust category under SOC 2 and includes ISO 27701 for privacy information management. Two gaps hold this off an A. Attorney client privilege and work product handling is not addressed directly in located material. Segregation between customers, users or matters is not documented on the pages checked.

The audience is broad by design and no position on the advice line was located. The platform is sold across legal, procurement, sales, finance and HR, handling NDAs, service agreements and HR paperwork alongside commercial contracts, and the AI drafts, redlines and negotiates for those users. Searched the vendor site, the platform and solutions pages, the company section and the research library on 29 Aug 2026 and located no statement on advice versus tooling, no treatment of competence or supervision duties, and no jurisdiction limits despite operation in more than 90 countries. The human first framing is a design posture rather than a professional responsibility position.

The intended audience is broad by design and no position on the advice line was located. Dedicated pages address legal operations and general counsel alongside procurement and IT, and vendor material describes the platform as serving business teams that touch contracts, with the AI proposing redlines and drafting negotiation ready revisions for those users. Searched the site, the product and persona pages, the security page and the support documentation via search on 29 Aug 2026 and located no statement on advice versus tooling, no treatment of competence or supervision duties, and no jurisdiction limits. The human in the loop governance language is a control statement rather than a professional responsibility position, and the two are not the same thing.

Responsible AI principles are published without a mechanism a buyer could audit. The vendor positions itself as AI native and human first, states that agents operate within customer set boundaries, and publishes annual research engaging seriously with buyer concerns about AI, reporting that 55 percent of contracting leaders cite data output quality as a significant concern and 44 percent lack sufficient trust in autonomous AI. Engaging publicly with the trust deficit in your own category is a real editorial position. But searched the vendor site, the research library, the company section and three targeted searches on 29 Aug 2026 and located no published AI governance framework, no AI management certification such as ISO 42001, no named owner of model governance, no pre release testing regime, and nothing on uneven output across matter types, parties or populations.

A published governance framework with real substance, short of testing results, a named owner and any bias disclosure. What exists is a described mechanism rather than a principles page: governed and auditable AI review frameworks, human in the loop governance stated as ensuring every agent is transparent, auditable and controllable, customer ability to review, override and continuously govern agent behaviour across teams and contract types, and administrator configurable permissions determining who may view, create and edit the playbooks that drive AI behaviour. A chief technology officer is named publicly as owning the AI roadmap. Not located as of 29 Aug 2026: an AI management certification such as ISO 42001, published pre release testing results, a named accountable owner for model governance as distinct from the technology function, and anything on uneven output across matter types, parties or populations.

A generic security posture covers the platform without addressing what happens to documents and prompts after processing. Located: encryption at rest and in transit and permission based management, from a 2017 company news item; hosting on Microsoft Azure; and, from a Microsoft published customer story rather than from Icertis, use of Defender for Cloud to monitor Azure OpenAI deployments, detect malicious prompts and enforce security policies, with built in ISO 27001, SOC 2 and NIST framework mappings across subscriptions and multicloud visibility into AWS. That last source is a partner marketing case study about Icertis as a Microsoft customer, not Icertis publishing its own posture, and is weighted accordingly. Not located as of 29 Aug 2026: retention period, deletion control, subprocessor list, and incident or breach notification practice.

Substantive published policy covering most of the ground. Certification breadth is the strongest element and is stated precisely: routine audits producing third party SOC 1 and SOC 2 Type II reports certified against multiple trust categories named as security, availability, confidentiality and privacy, plus ISO 27001, 27701, 27017 and 27018, a dedicated GDPR programme, and Cloud Security Alliance membership with Trusted Cloud Provider status. Data centre operations run on public cloud providers the vendor states are themselves certified under SOC 2, ISO 27001 and PCI DSS, across multiple regions. Zero data retention is enforced at the external model layer. Not located as of 29 Aug 2026: a stated retention period or deletion control for customer contracts and prompts in Ironclad's own systems, a named subprocessor list, and an incident or breach notification practice.

Searched the vendor site navigation, the platform and solutions pages, the company section, the news and research libraries and three targeted searches on 29 Aug 2026. No published indemnity, liability cap, carve out, warranty on output or insurance position was located, and no customer agreement, terms of service or master services agreement was located as published on the property. Recorded as a pure absence on the surfaces reached. Rebuttable with a single link, and see the build log note on this record's evidence floor.

Searched the site navigation, the security page, the Ironclad AI and Jurist product pages, the support documentation and the article library via search on 29 Aug 2026. No published indemnity, liability cap, carve out, warranty on output or insurance position was located, and no customer agreement or master services agreement was located as published on the property. Recorded as a pure absence on the surfaces checked. Rebuttable with a single link to a published agreement, which for an enterprise platform of this size may well exist somewhere not surfaced by the searches run.

Integration is claimed at platform level without documentation an implementer could use. The vendor describes an enterprise wide contract intelligence layer connecting agreements, data and systems, and Microsoft Azure hosting with Microsoft as a strategic partner is stated, which implies but does not document connection into the Microsoft estate. Searched the vendor site, the platform pages and the company section on 29 Aug 2026 and located no integrations page, no named connector for ERP, CRM, document management or e signature, and no description of what any integration moves or what an administrator configures. For an enterprise platform whose competitive set is named as including SAP Ariba and DocuSign CLM, and which sells into procurement and finance, that absence on the pages reached is notable.

Real integrations exist and are documented, and the vendor treats them as a primary differentiator. Named specifically: Salesforce, described by the vendor as the number one Salesforce integration in the market, and Coupa, with a dedicated integrations page and a stated claim of the deepest integrations in the market. The workflow layer is itself integration: teams create, manage and collaborate on contracts from inside the systems they already use rather than switching into the CLM. Orientation is toward enterprise commercial systems rather than legal document management, which fits a CLM buyer. Not located as of 29 Aug 2026: legal specific document management connectors such as iManage or NetDocuments, and per integration documentation describing what moves in which direction and what an administrator configures.

Cloud delivery is stated and neither the tenancy model nor the region is given. Microsoft Azure is named as the hosting platform, which is more than several records on this index disclose, and the vendor states operation across 90 plus countries and support for multiple nations and languages. Searched the vendor site, the platform pages and the company section on 29 Aug 2026 and located no list of available regions, no customer selectable residency, no tenancy model, and no statement separating where processing happens from where data is stored. Operating in many countries is a market claim rather than a residency position.

Residency is offered without the processing location being addressed, which is the B band. The vendor states it leverages multiple data centre regions from its cloud providers specifically to meet data residency requirements, which is a real published residency position rather than a geography footnote. What is missing: the cloud providers are described only as public cloud vendors and are not named, no available regions are listed, no customer selectable region is stated, no tenancy model is given, and no statement separates where processing happens from where data is stored. Checked the security page and the platform pages via search on 29 Aug 2026.

CORRECTED 29 Aug 2026 during the trust portal sweep. The grade stays at C but the previous reasoning was wrong and is withdrawn. That note stated no certification was stated by the vendor on any page reached and that standards references came only from a Microsoft published customer story. A vendor published document has since been located on icertis.com, an information security framework, in which the vendor states it is an ISO 27001, ISO 27017 and ISO 27018 certified organisation, holds SOC 2 Type 1 and Type 2 certifications, complies with ITAR, and hosts the ICI Platform on Microsoft Azure, directing readers to Azure's own compliance documentation for data centre coverage. So the certifications are named by the vendor after all, and the earlier note misstated that. Why the grade nonetheless remains C. The document is versioned Q1 2022 and is the only vendor published certification statement located after four separate searches, so the currency of every claim in it is unverified more than four years on. No ISO version numbers are given, so whether the 27001 certification sits at the 2013 or 2022 revision is unknown, and the 2013 revision has since been withdrawn. No coverage period, no audit scope, no report date and no named auditing firm were located. No trust portal or published request route for compliance reports was located. Naming standards in a stale document without scope, currency or an evidence route is the C band. Rebuttable by any current certification page.

Certification is real and stated with correct scope language, short of accessible evidence. The vendor names SOC 1 and SOC 2 Type II from routine third party audits and, unusually, names the trust categories certified against: security, availability, confidentiality and privacy. ISO 27001, 27701, 27017 and 27018 are all named, which is a broader ISO set than most of this index carries, and Cloud Security Alliance membership with Trusted Cloud Provider status is stated. Supply chain assurance is addressed by stating that the underlying cloud vendors are themselves SOC 2, ISO 27001 and PCI DSS certified. What was not located as of 29 Aug 2026 is the evidence route: no audit coverage period, no report date, no named auditing firm, and no trust portal or published request flow for obtaining the reports.

The vendor refers to AI capability without identifying what sits underneath, though the chain is partly inferable. Microsoft is named as a strategic partner and Azure as the platform, and a Microsoft published customer story records Icertis monitoring Azure OpenAI deployments, which indicates Azure OpenAI is in the stack. That is a partner disclosure rather than a vendor one, and the distinction matters: naming a hosting partnership is not naming which models serve which task. Searched the vendor site, the platform and research pages and the company section on 29 Aug 2026 and located no named model provider stated by Icertis, no statement of where models run, no subprocessor list, and no commitment to notify customers when the supply chain changes.

The vendor refers to models without identifying what sits underneath. Two layers are acknowledged and the distinction between them is drawn clearly, which is more than most manage: proprietary legal AI models built by Ironclad with legal engineered prompts, and external LLM providers bound by do not train and zero data retention terms. That tells a buyer the shape of the chain and the commercial terms binding it. What it does not tell them is who is in it. Searched the site, the Ironclad AI and Jurist pages, the security page and the article library via search on 29 Aug 2026 and located no named external model provider, no statement of where models run, no subprocessor list, and no commitment to notify customers when the supply chain changes.

Checked the vendor site navigation, the platform and solutions pages, the company section and the research library on 29 Aug 2026. No pricing page was located, no rate is published, no unit of charge is stated and no tier structure appears. Every commercial path located terminates in a demo or contact request. No free trial or self serve entry point was located, and no third party pricing figure was located either.

Checked the site navigation, the platform and product pages, the persona pages and the security page via search on 29 Aug 2026. No pricing page was located on the property, no rate is published, no unit of charge is stated and no tier structure appears. Every commercial path located terminates in a demo request. No free trial or self serve entry point was located. Consistent with third party coverage describing implementation cost as dependent on the scope of the CLM deployment rather than on a published rate.

Segment coverage is described with substance, short of the boundaries. The buyer is stated clearly as the large enterprise, with 30 percent of the Fortune 100 claimed across 90 plus countries and multiple languages, and the platform explicitly spans buy side and sell side agreements rather than one direction. Industry breakouts are published in the vendor's own research covering public sector, healthcare and life sciences, and banking and insurance among others. Functional coverage spans legal, procurement, sales, finance and HR. Not located as of 29 Aug 2026: any statement of which organisation sizes, contract types or practice areas the platform is not built for. Third party reviews state that small and most mid market businesses will find it more platform than they need, which is exactly the boundary statement the vendor does not make itself.

Segment coverage is described with substance, short of the boundaries. Four buyer personas carry their own published positioning: legal operations, general counsel, procurement and IT, and the vendor addresses business teams beyond legal that touch contracts. Enterprise class and global business teams are stated as the target, and at least one industry, manufacturing, carries dedicated positioning around leakage and contract performance. Practice scope is clear and consistent throughout: contracting end to end from intake to post signature, with no claim to litigation or research capability. Not located as of 29 Aug 2026: a statement of which organisation sizes or contract types the platform is not built for, and an enumerated industry or practice area list comparable to the strongest records on this index.

Searched the vendor site, the platform and company sections, the news and research libraries, and ran three separate targeted searches for a trust centre or security page on 29 Aug 2026 without reaching one. No located term or policy addresses whether customer content may be used to train models, either way. Recorded as silent under the rule that a value is never inferred from the absence of a contradiction. Note the evidence limit stated in the build log: this is the one record on the index where the vendor's own security material was not reached, so this value reflects what a buyer can find by searching rather than a reading of a located policy that stays quiet.

The clearest opt in on this signal in the index, and the vendor argues for it openly rather than burying it. Published: customers may opt into allowing Ironclad to train its own models on their contracting data; any customer data so used is anonymised and aggregated before use; output generated for other customers by models trained on that data will never include the contributing customer's data; and the customer stays in control with data kept confidential. Separately and distinctly, strict do not train and zero data retention policies are enforced with external LLM providers, so the third party layer is prohibited while the vendor's own layer is permitted with consent. Recorded at opt in because training occurs only where the customer has affirmatively enabled it. What was not located as of 29 Aug 2026 is where the opt in is exercised, whether it sits in the agreement or a product setting, and whether it can be withdrawn.

Searched the vendor site, the platform and company sections, the news and research libraries and three targeted searches on 29 Aug 2026. No public material states how long contracts, prompts or outputs are retained, whether a customer controls the window, or whether deletion is available. The platform is a system of record designed to hold executed agreements and their obligations for their full life, so retention is central to what is being bought, and no published terms attach to it on the surfaces reached.

Retention is answered at the external model layer and unaddressed for the platform itself. The vendor states it enforces zero data retention with external LLM providers, so prompts and completions are not persisted by those providers. Searched the security page, the platform pages, the article library and the support documentation via search on 29 Aug 2026 and located no retention period for contracts, prompts or outputs held in Ironclad's own repository, no customer control over that window, and no deletion commitment. That gap is material here because the product is a system of record designed to hold every executed agreement indefinitely, so the retention question is the core of what the customer is buying.

Segregation is asserted in public materials with no published detail on how it is enforced. The located statement is that the platform stores agreements on GDPR compliant infrastructure with encryption at rest and in transit under a permission based management approach, and third party review material refers to standardised workflows and access controls. That is an access model asserted rather than described: no roles, no scoping rules, no statement of whether retrieval by the AI layer respects those permissions per user, and the primary source is a company news item from 2017. No document management integration was located whose permissions the product could inherit. Recorded at claimed but not documented.

The product maintains its own documented permission model rather than inheriting one from a document management system. Published support documentation states that administrators can configure Ironclad users and groups to permit or restrict which users may view, create and edit AI Playbooks, so the standards driving AI behaviour are themselves access controlled, and the workflow layer routes and assigns contracts across named reviewers. That is a documented internal permission model. What was not located as of 29 Aug 2026 is segregation of the contract repository itself between users or matters, any ethical wall concept, and any legal document management integration whose permissions retrieval could inherit at query time. Noted for context: the buyer here is an in house or business team rather than a firm carrying conflicts obligations, so the question reads differently than it would for a firm facing product.

Searched the vendor site, the company section, the news library and three targeted searches for published terms, a privacy policy or a trust centre on 29 Aug 2026. No clause committing to notify a customer of a government or law enforcement request for their data was located, and no transparency report was located. No published customer agreement or data processing agreement was reached on the property, so the search covered public marketing and news pages rather than contract documents.

Searched the security page, the site navigation, the article library and the support documentation via search on 29 Aug 2026. No clause committing to notify a customer of a government or law enforcement request for their data was located, and no transparency report was located. No published customer agreement or data processing agreement was located on the property either, so the search covered the public pages rather than the contract documents.

No primary law corpus is identified because the product does not appear to hold one. Retrieval runs against the customer's own contract repository, templates and clause library, so the corpus is the customer's own agreements and its provenance is theirs. Searched the vendor site, the platform pages and the research library on 29 Aug 2026 and located no vendor supplied legal corpus, no licence basis and no update cadence. Noted for a reader: this is the same architectural shape as Definely and Ironclad, where the absence on this signal describes the product design rather than a disclosure failure.

No primary law corpus is identified because the product does not hold one. Retrieval runs against the customer's own contract repository and their own AI Playbooks, and the vendor's proprietary models are described as trained on legal terminology and contract management architecture with legal engineered prompts, plus, where customers opt in, anonymised and aggregated customer contracting data. That last element is the closest thing to a vendor corpus and its provenance is disclosed in principle, being customer contributed under consent, though no scale figure, licence basis or update cadence is published for it. Searched the site, the Ironclad AI page and the article library on 29 Aug 2026.

Searched the vendor site, the platform pages and the research library on 29 Aug 2026. No material was located addressing whether authority carries a treatment signal or whether subsequent history is checked, and no commercial citator licence was located. Noted for context: this is a contract lifecycle platform grounded in the customer's own agreements with no case law research surface, so a citator is outside its design entirely.

Searched the site, the product pages and the support documentation via search on 29 Aug 2026. No material was located addressing whether authority carries a treatment signal or whether subsequent history is checked, and no commercial citator licence was located. Noted for context: this is a contract lifecycle platform grounded in the customer's own playbooks and repository, with no case law research surface, so a citator is outside its design entirely.

Searched the vendor site, the platform pages, the research library and the 2026 event coverage on 29 Aug 2026. No published material describes what the product does when it cannot ground an answer, and no explicit no answer path or confidence signal exposed to the user was located. The vendor's boundaries language describes limits a customer sets on what an agent may do, which is a permission concept rather than a statement about what the system does when it does not know.

Searched the site, the Ironclad AI and Jurist pages, the agent launch material and the support documentation via search on 29 Aug 2026. No published material describes what the product does when it cannot ground an answer, and no explicit no answer path or confidence signal exposed to the user was located. The Review Agent is documented as identifying missing clauses and compliance gaps, which is flagging what is absent from a contract rather than the system declining to answer, and the two were not conflated.

No court order, opinion or disciplinary record naming this product has been located as of 29 Aug 2026. Instrument searched: the AI Hallucination Cases database maintained by Damien Charlotin, which tracks court decisions worldwide involving AI generated hallucinated content and records the AI tool implicated where it is known. Also checked published 2026 sanctions summaries and secondary sanctions trackers. The entries located name filers, and in some rows other products, rather than this one. This is a statement about the public record on the date shown and not a clearance. Note that this is a contract lifecycle platform with no case law research surface, so its output is very unlikely to reach a court filing as cited authority.

No court order, opinion or disciplinary record naming this product has been located as of 29 Aug 2026. Instrument searched: the AI Hallucination Cases database maintained by Damien Charlotin, which tracks court decisions worldwide involving AI generated hallucinated content and records the AI tool implicated where it is known. Also checked published 2026 sanctions summaries and secondary sanctions trackers. The entries located name filers, and in some rows other products, rather than this one. This is a statement about the public record on the date shown and not a clearance. Note that this is a contract lifecycle product with no case law research surface, so its output is very unlikely to reach a court filing as cited authority.

Searched the vendor site, the research library including the State of Contracting reports, the blog and the news index on 29 Aug 2026. No engagement with any named ethics opinion or bar guidance was located, including ABA Formal Opinion 512 and state bar guidance. The vendor publishes substantial annual research on AI adoption and trust in contracting, which surveys practitioner sentiment rather than engaging with the professional responsibility rules its legal buyers are bound by.

Searched the site, the article library, the persona pages and the community and resources sections via search on 29 Aug 2026. No engagement with any named ethics opinion or bar guidance was located, including ABA Formal Opinion 512 and state bar guidance. The vendor publishes substantial material on AI governance, auditability and human in the loop control, which addresses how its own system is controlled rather than the professional responsibility obligations its legal buyers are bound by.

Vendor material is framed around business outcomes rather than hours: growing revenue, controlling costs, mitigating risk and ensuring compliance, with published claims about drafting faster and executing with greater precision. Searched the vendor site, the platform pages, the research library and the news index on 29 Aug 2026 and located no per matter record of AI assisted work intended for fee purposes, and no guidance on billing, fee or client disclosure treatment. Noted for context: the buyer is a corporate legal, procurement or finance function rather than a firm billing a client by the hour, so this signal reads differently for this segment, and the savings framing here is enterprise cost rather than billable time.

Savings are claimed and quantified with nothing published on the client's side of the equation. Published figures include a named customer recovering 50 percent of legal operations time, first pass redlines moving from up to a couple of hours down to minutes, and MNDA review moving from up to a day down to minutes or seconds, alongside framing about scaling review without adding headcount. Searched the site, the product pages, the article library and the support documentation via search on 29 Aug 2026 and located no per matter record of AI assisted work intended for fee purposes, and no guidance on billing, fee or client disclosure treatment. Noted for context: the buyer is an in house or business team that does not bill a client by the hour, so this signal reads differently for this segment.

Searched the vendor site, the company section, the news and research libraries and three targeted searches for a trust centre, security page or certification listing on 29 Aug 2026 without reaching one. No subprocessor list, no statement of which model providers see customer content, no published data processing agreement and no client facing consent or notification material was located. Standards references located for this vendor come from a Microsoft published customer story rather than from Icertis, which is not a disclosure a firm could forward to its own client as the vendor's own commitment.

Substantial certification material is published openly, including SOC 1 and SOC 2 Type II with the trust categories named, ISO 27001, 27701, 27017 and 27018, a GDPR programme and Cloud Security Alliance Trusted Cloud Provider status, all reachable without a sales conversation. But the artifacts this signal turns on were not located as of 29 Aug 2026: no subprocessor list, no statement naming which model providers see customer content, no published data processing agreement, and no client facing consent or notification pack. The vendor states its external LLM providers are bound by do not train and zero data retention terms without naming them, which is a statement about the terms rather than a disclosure of the chain. Recorded as not addressed because no list exists to point to.

Searched the vendor site, the platform pages and the research library on 29 Aug 2026. Third party review material refers to standardised workflows and access controls, and the platform tracks obligations and approvals per contract, so a workflow trail plausibly exists, but no vendor material describes an export covering model used, sources retrieved and human verification together, and no model is named by the vendor so the model used could not be stated. Noted for context: this is a contracting platform rather than a litigation product, so a judicial AI disclosure order is unlikely to reach its output.

Some elements of a record are available and the auditability language is more specific than most. The vendor publishes governed and auditable AI review frameworks with human in the loop review, stating customers get transparent auditable AI behaviour they can review, override and continuously govern across teams and contract types, and the workflow layer records routing, assignment and approvals per contract. Two elements are missing: no per document export covering model used, sources retrieved and human verification together was located, and no model is named anywhere in published material so the model used could not be stated. Noted for context: this is a contracting platform rather than a litigation product, so a judicial AI disclosure order is unlikely to reach its output.