Icertis vs Miramis: how they compare in 2026
Icertis and Miramis both sell enterprise contract lifecycle management built around AI agents. Icertis does it through its Vera agents across authoring, obligations and analytics. Miramis does it through PLAI, which reviews each incoming redline against the company's playbook and tells business teams what they can accept. The widest difference is what each agreement says about customer contracts and AI. Miramis's terms bar using customer data to train any foundational model. Its data processing agreement names OpenAI and Google Vertex AI as its model providers with processing in the EU, commits to breach notice within eight hours and lets customers object to a new subprocessor. Icertis's agreement lets it use customer data to maintain, develop and improve its service. Icertis's counterweight is enterprise depth: single or multi tenant deployment in an Azure data center the customer picks, a separate FedRAMP cloud, and a published insurance schedule including $5 million of technology errors and omissions cover. Both publish a complete liability position.
Which one fits
Choose Icertis if
- You need to choose tenancy and data center. Icertis's agreement offers single tenant subscribers their own upgrade schedule alongside a multi tenant option, lets the customer pick the Azure data center at the outset, keeps geo replicated backups, and lists a separate FedRAMP government community cloud.
- You want insurance standing behind the contract. Icertis commits to general liability cover of $1 million per occurrence, technology errors and omissions including cyber liability of $5 million and umbrella cover of $5 million for the term and a year after, alongside an intellectual property indemnity and a twelve month fee cap.
- Your contracts span buy side and sell side across many countries. Icertis says it serves 30 percent of the Fortune 100 in more than 90 countries, covers procurement, sales, legal, finance and HR agreements, and holds ISO 27001, 27017 and 27018 with SOC 2 Type 1 and Type 2.
Choose Miramis if
- You want sales, HR and procurement to handle routine contracts within rules legal sets. Miramis lets legal fix templates, non negotiable terms and a delegation of authority once, and its PLAI agent reviews every incoming redline and says what can be accepted, what must change and what goes to legal.
- Your data must stay in Europe. Miramis's data processing agreement lists nine subprocessors, including OpenAI and Google Vertex AI, all with EU or EEA residency, gives 30 days to object to a new one, and commits to written breach notice within eight hours of discovery; signing is eIDAS compliant with BankID and MitID.
- You want the training bar and certifications written into the contract. Miramis's terms state that no customer data will be used to train any foundational AI model, and warrant that it will keep ISO 27001 and SOC 2 Type II certification, or an equivalent, for the whole term.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The AI offering runs through Vera, an agent layer across Engage, Operate and Analyze. In Vera Engage, Composer drafts NDAs and statements of work from a conversation, Playbook Creation builds review playbooks, Risk Review flags issues with clickable citations to the clause, and Redline proposes changes against the playbook. Vera Copilot, reimagined in June 2026, answers questions across the portfolio, and the Vera Fulfillment Agent rates compliance and approves fulfillment. A multi model gateway sits under the agents. These sit on a contract platform for authoring, negotiation, approval, execution, obligation management and analytics, sold as Icertis Contract Management (ICM), which runs without the models. Vera adds an agent layer to that platform rather than replacing it.
PLAI reviews redlines against the playbook, extracts metadata into the repository, answers portfolio questions and generates dashboards, and the vendor describes it as built into every workflow rather than bolted on. Without it, templates, self-serve drafting with CRM data, approval routing on a Delegation of Authority, native eIDAS e-signing, the repository and renewal alerts remain, which is a working CLM; terms section 2.1.1 describes the service as an AI contract lifecycle management platform and the definitions treat Miramis AI as a feature of it. The AI-native label is the vendor's positioning; the structure is a CLM with a model layer.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Icertis describes a contract intelligence engine that extracts clauses, obligations and risk and turns them into queryable data. Vera Risk Review lets a reviewer jump to any flagged clause through clickable citations, so a finding links back to the passage in the contract. Wilson Sonsini's March 2026 customer story reports 95 percent accuracy on first party contracts, 92 percent on third party contracts and 94 percent on issue detection, measured in the firm's own bake off against a 90 percent target. Icertis publishes no test set, hallucination rate or evaluation method of its own, and does not describe how the agents retrieve the text they rely on.
Terms section 5.2.1 says that, given the probabilistic nature of the technology, output may be inaccurate, incomplete or misrepresent people, places or facts. Section 5.2.2 disclaims any warranty on the accuracy or correctness of output, and the acceptable use policy requires the customer to review outputs before use. No accuracy figure, test set or evaluation is published, and no measure of how often PLAI's redline assessments are wrong. Citation checking against primary law does not apply: PLAI grounds its review in the customer's own playbook, templates and Delegation of Authority, not in primary law.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Vera Composer gathers NDA or statement of work details through conversation, converts them into structured context, and assembles a draft using approved templates, clauses and business rules, tracking clause selection, template usage and edits for audit trails. Vera Redline compares uploaded contracts with playbooks, exposes clause references and explanations, and proposes targeted changes for review. Vera Risk Review keeps a person validating the output at every step, while the Fulfillment Agent can approve fulfillment on its own once it has rated compliance, keeping a complete audit trail. The broader platform lets customers set boundaries for autonomous agents. Icertis does not give exact stop thresholds, configuration permissions or correction procedures after an accepted error.
Business teams in sales, HR and procurement handle contracts autonomously within guardrails legal defines, drafting from pre-approved templates and negotiating in-platform, while PLAI reviews each incoming redline and states what can be accepted, what must change and what needs escalation; metadata extraction and approval routing run automatically. Legal sets the rules once, which templates, which terms are non-negotiable and who approves what, and the Delegation of Authority determines approvers and signatories on every contract. Flagged redlines carry suggested alternative wording, approvals route automatically before signature, and every action has a complete audit trail. Anything outside the playbook escalates to legal, and the acceptable use policy and terms section 2.3.2 prohibit using the AI as the sole basis for any decision affecting legal rights without prior human review.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Icertis publishes named customer stories with figures. Stanford Health Care cut contract turnaround from 25.4 days to 17.2 days, with about $11.6 million in savings (August 2026). Microsoft's cloud operations team cut the handoff from SAP Ariba from two hours to 15 minutes across more than 10,000 contracts (March 2026), and Icertis's own procurement team reports 30 percent lower legal spend (August 2026). Mercedes-Benz reports 83 percent faster turnaround (2023), HPE runs more than 100,000 contracts on the platform, and ALPLA and Ferring report gains of 60 percent and more than 50 percent. Wilson Sonsini's March 2026 story gives the accuracy results of its own bake off. Icertis says it serves more than 400 enterprises, including 30 percent of the Fortune 100. The stories state results without a measurement method a reader could repeat.
BabyBjörn's general counsel, David Grünbaum, is quoted that the company improved efficiency six times by streamlining legal flows with Miramis and that each department now handles its own standardized legal tasks; no date, baseline or method accompanies the figure. Further general counsels or heads of legal are named with attributed quotes and no figures: Strömma, Svea Solar, Cambio, Eton, Treyd, PortmanDentex, Secret Escapes and Almedia. The home page's own figures, cycle time falling from 21 days to three to five, are unattributed, and its animated counters for time from draft to execution, hours saved and cost saving render without values. Miramis also publishes a customer stories page.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The SaaS Subscription and Services Agreement sets out role based access control, identity provider authentication, audit logs of every user action, encryption at rest and in transit, and a single tenant option. Section 4.5 returns Subscriber Data on request and permits destruction if it is not requested within five days of termination. Section 5.2 lets Icertis use Subscriber Data, including output, to maintain, develop and improve the service, provided the data is not shared with third parties and the Subscriber stays anonymous. The agreement does not address attorney client privilege or work product, or say how the Vera agents respect user permissions. A 2017 company news item describes storage on GDPR compliant cloud infrastructure with encryption at rest and in transit. Icertis also links a Trust Center from its site.
Terms section 6.2.5 says no customer data will be used, directly or indirectly, to train any foundational AI model, with foundational carried as a qualifier. Role based permissions down to document level and SSO are stated on the help center and home page, and section 6.1 defines customer data as confidential information. DPA section 16 requires destruction or return on termination and destruction within twelve months in any case. Section 6.2.4 says input goes to and output comes from third party LLM providers under their terms, section 8.3 treats them as subprocessors, and Schedule 1 names OpenAI and Google Cloud Vertex AI with EU or EEA residency. Nothing addresses privilege or work product handling, although the users include a legal team negotiating for the company.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Icertis sells the platform across legal, procurement, sales, finance and HR, where it handles NDAs, service agreements and HR paperwork alongside commercial contracts. Its AI drafts, redlines and negotiates for all of those users. The product pages, company section and research library take no position on where a tool ends and legal advice begins, and say nothing about competence or supervision duties. They set no jurisdiction limits, although Icertis operates in more than 90 countries. Its framing of agents that execute while humans govern describes how the product is designed rather than a position on professional responsibility.
Terms section 5.2.2 says Miramis provides self serve technology, is not a law firm or a substitute for a lawyer, and gives no legal advice. Section 2.3.2 bars using the services in any way that would constitute or substitute for legal advice, the practice of law or automated decisions about people. The acceptable use policy of 11 February 2026 repeats both and requires human review before any decision affecting legal rights. The product is sold for business users to handle contracts without legal expertise. Nothing addresses how the product supports a supervising lawyer's duties beyond its guardrails, and no jurisdiction limit is named, apart from the caveat in section 2.5.2 that local law may impose electronic signature requirements the platform does not meet.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Icertis describes its model as agents executing while humans govern, with agents operating within boundaries the customer sets, and it publishes annual research on buyer concerns about AI. That research reports that 55 percent of contracting leaders cite data output quality as a significant concern and 44 percent lack sufficient trust in autonomous AI. Its Trust Center lists an AI Governance item behind an access request. The open product pages and research library describe no AI governance framework, no AI management certification such as ISO 42001, no named owner of model governance and no testing before release, and nothing on uneven output across matter types, parties or populations.
The acceptable use policy carries AI usage rules and requires human review before decisions that affect rights. Terms section 5.2.1 acknowledges the limits of probabilistic output and says Miramis continually strives to improve accuracy, reliability and safety. No governance framework, accountable owner, ISO 42001 or similar certification, description of testing before release, or statement about uneven output across contract types or business teams is published, and the site has no AI principles page.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Section 4.5 of the agreement returns Subscriber Data on request at no fee and permits destruction if it is not requested within five days of termination. Exhibit B sets out strict role based access, identity provider authentication with multifactor support, audit logs of all user actions, encryption at rest and in transit, Azure network security groups and threat monitoring. It also commits Icertis to notify the Subscriber of any breach resulting in loss or unauthorized disclosure of Subscriber Data, under a documented incident process. Section 6.1 bars sale of personal data and its combination with other sources, while section 5.2 permits use of Subscriber Data to develop and improve the SaaS. The Privacy Statement, last updated 25 November 2025, says data may be transferred to the United States, India or other countries. A List of Standard Sub-Processors dated 26 May 2026 is published on the foundation page.
Terms of service version 2.2 of 18 February 2026 and the DPA appended to them cover retention, deletion, access control, sub-processors and incident practice. DPA section 16 requires destruction or return of personal data on termination and destruction within twelve months regardless, and terms section 2.3.4 requires reasonable prior notice before Miramis deletes customer data for breach. Schedule 2 lists access-level controls, access logging, VPC, two-factor authentication and password management, and the home page and help center add SSO and document-level role permissions. Schedule 1 lists nine sub-processors by name, service and data residency, all EU or EEA, including AWS, Azure, OpenAI, Google Cloud Vertex AI, Signicat, Idura, Auth0 and Twilio SendGrid, with a 30-day objection window on additions under DPA section 7. DPA section 5.1 commits to written breach notice within eight hours of discovery with the circumstances, categories, consequences, measures and a contact. The help center adds that data sent through the AI integrations is not stored at the provider.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Section 9.1 of the agreement gives a defense and indemnity for third party intellectual property claims, for claims by Icertis subcontractors or personnel, and for gross negligence causing injury or property damage. It states an exclusion for Subscriber Data. Section 10.1 excludes consequential loss, and section 10.2 caps each party at the amounts Icertis received in the preceding twelve months. Section 8.2 warrants noninfringement, professional performance and material conformity to the documentation, with a correction remedy and a termination right. Section 10.4 commits Icertis to carry commercial general liability cover of $1 million per occurrence and $2 million in aggregate. It adds technology errors and omissions cover including cyber liability of $5 million, umbrella cover of $5 million and employer's liability. The cover comes from a carrier rated A minus, runs for the term and one year after, and a certificate is available on request. The agreement gives AI output no separate warranty. An AI Acceptable Use Policy sits on the foundation page as an addendum to the agreement.
A vendor indemnity against third-party IP infringement claims arising from use of the services sits in terms section 5.4, with its exclusions listed in 5.4.2 and the remedies in 5.4.3 including a refund of prepaid fees on termination. Section 5.3 caps each party's liability at fees paid in the preceding twelve months, excludes indirect loss, and carves out fraud, willful misconduct and gross negligence; section 5.3.4 sets a twelve-month claims window. Section 5.1.1 warrants that the services conform to specification and are performed professionally, with the remedy in 5.1.2. Section 5.2.2 then states that Miramis bears no legal responsibility and gives no warranty for the accuracy, correctness or fitness of output, and section 5.5 has the customer indemnify Miramis for claims arising from input and use of output. DPA section 13.3 adds an indemnity for processing against instructions. No insurance is stated. The terms are the self-serve agreement, and order forms prevail on conflict.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Prebuilt adapters for SAP, Microsoft, Salesforce, Workday, Adobe Sign and DocuSign sit on a Native Integrations page, each described by what it moves. The SAP Ariba adapter syncs procurement contracts, line items and suppliers, and the SAP S/4HANA adapter brings buy side supplier master data into the platform. For ERP and finance, adapters for Microsoft Dynamics 365 Finance and Operations and for Workday Financials sync procurement contracts, suppliers and financial data. The Salesforce CRM and CPQ adapter creates contracts from accounts, opportunities and quotes, with two way sync of deal and pricing data, and a Dynamics 365 Sales adapter keeps contract and sales data in step. The Adobe Sign and DocuSign adapters return signed agreements and audit trails to the platform. Microsoft Teams, Microsoft 365 for the web and Outlook connections cover collaboration, and SAM.gov and federal clause adapters serve public sector work. Licensed public APIs and connections to OpenAI, Claude, Microsoft Copilot and SAP Joule agents round out the list. The page does not describe setup or what an administrator configures, and it names no document management or identity connector. The platform runs on Microsoft Azure, with Microsoft as a strategic partner, and its named competitors include SAP Ariba and DocuSign CLM.
Salesforce and HubSpot are described as pulling deal data directly into contract drafts, the Word add-in as keeping redlines synced with the platform, and DocuSign as a supported alternative to native e-signing; Teams, Slack, SharePoint and Google Drive are named on the home page without a description of what moves. A WebAPI is offered for custom connections and public developer documentation exists, still hosted at the pocketlaw-api domain, and a May 2026 release named Miramis Connect exposes the platform to external AI agents. Miramis also publishes an integrations page. No document management or matter management system is named.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Exhibit B of the SaaS Subscription and Services Agreement states that the platform is hosted on Microsoft Azure and that the Subscriber may select the Azure data center at the outset of the subscription. Production backups sit on geo replicated Azure storage. Exhibit A-2 distinguishes single tenant subscribers, who schedule their own upgrades and receive wider version support, from multitenant subscribers on the automatic upgrade calendar, so both tenancy models are offered. A FedRAMP government community cloud is listed separately. The agreement does not say where model inference runs.
DPA Schedule 1 gives EU or EEA data residency for every sub-processor including both model providers, DPA section 12 states processing is primarily within the EU or EEA with adequacy, standard contractual clauses or equivalent safeguards for anything outside, and the help center states EU data residency is available. That places both storage and model processing in the region. Nothing states whether customers share infrastructure or receive a dedicated tenant, no region outside the EU is offered, and nothing describes what changes between plans.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Icertis's Trust Center, updated September 2026, lists a SOC 2 Type 2 report for January to December 2025, a SOC 1 Type 2 report for January to June 2026 with a bridge letter, ISO 27001:2022, ISO 27017:2015 and ISO 27018:2019, FedRAMP High, TISAX, NIST 800-171, Cyber Essentials Plus and ITAR compliance. The reports sit behind an access request. Exhibit B of the SaaS Subscription and Services Agreement adds risk management under the ISO 27001 framework, regular third party vulnerability assessments and penetration testing, and AES-256 encryption at rest. Encryption keys are managed by Microsoft Azure, and Icertis can manage them in Azure Key Vault where required. The open pages name no auditor.
Miramis is ISO 27001 and SOC 2 Type II certified under terms section 6.2.6, which also commits it to maintain the certification or an equivalent throughout the term. The home page and help center repeat both and add regular penetration testing. No auditor, coverage period, scope or route to the report is published, and there is no trust center. The site also lists a Security page and a Security Policy. The control detail in DPA Schedule 2 is a list of headings rather than a description.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Icertis names Microsoft as a strategic partner and Azure as its platform. It was a launch partner for the Azure OpenAI Service in 2022, describes Vera as built for contracts using Azure AI, and lists a multi model gateway in its platform. Its integrations page lists interoperability with OpenAI, Claude (Anthropic), Microsoft Copilot and SAP Joule agents, and Vera is embedded in Microsoft 365 Copilot. No source says which models power Vera, the Copilot or the contract intelligence engine, or which model serves which task. The agreement and product pages do not say where models run or commit to notifying customers when the model supply chain changes. A List of Standard Sub-Processors dated 26 May 2026 sits on the foundation page.
DPA Schedule 1 names OpenAI and Google Cloud Vertex AI as the AI sub-processors with EU or EEA residency, terms section 8.3 deems the model provider a sub-processor, and DPA section 7 requires written details and a 30-day objection window before any sub-processor is added. The definition of Miramis AI names OpenAI's GPT models as an example, which is a model family rather than a named model, and nothing states which model runs which function.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
No pricing page, rate, unit of charge or tier structure appears on the Icertis site. Every commercial path on its site ends in a demo or contact request, and there is no free trial or self serve entry point. Outside figures exist. Vendr, a software buying service, is cited for a median Icertis contract of $88,000 a year, and Icertis has not confirmed it.
Licenses are per individual user under terms section 2.2.3. Section 4.1 sets twelve month initial and renewal terms with 90 days' notice to terminate, section 3.1.2 gives 120 days' notice of price changes, and section 3.2 sets 30 day invoice terms and 20 percent late interest. Section 4.4 provides for free trial accounts, and section 3.1.1 refers to standard subscription plans offered from time to time. The terms carry no figure. A pricing page at /pricing appears in the navigation and footer. A third party review says published pricing was withdrawn at the February 2026 rebrand, and aggregator listings carry older tiers; neither comes from the vendor.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Large enterprises are the market, with 30 percent of the Fortune 100 said to be customers across more than 90 countries and multiple languages, and coverage of buy side and sell side agreements rather than one direction. The vendor's own research publishes industry breakouts for public sector, healthcare and life sciences, and banking and insurance, among others. Functional coverage spans legal, procurement, sales, finance and HR. Icertis does not say which organization sizes, contract types or practice areas the platform is not built for. Third party reviews say small and most mid market businesses will find it more platform than they need.
The buyer is enterprise in-house legal, with solutions pages for legal, sales, HR, procurement, finance and IT, industries named as banking and financial services, manufacturing, retail and technology, and a mid-market to enterprise positioning in the vendor's own comparison pages. Coverage is European by design: Swedish and UK entities, eIDAS e-signing with BankID and MitID, EU residency, and a DORA clause for regulated customers. The stated limits are that e-signature validity may not meet enhanced local requirements and that some documents cannot be signed electronically. Nothing names a practice area or contract type the platform does not handle, or a position on use outside Europe.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Section 5.2 of the SaaS Subscription and Services Agreement licenses Icertis to use Subscriber Data to provide the SaaS. It also lets Icertis use Subscriber Data to maintain, develop and improve the SaaS, including creating industry relevant analysis, provided the data is not shared with third parties and the Subscriber stays anonymous. Subscriber Data is defined to include the output of processing. The clause does not name model training, though Icertis's Privacy Statement, last updated 25 November 2025, lists providing information to machine learning mechanisms among the uses of Subscriber Data, and its platform page says Vera is trained on its data lake. An Artificial Intelligence Acceptable Use Policy is listed on the foundation page as an addendum to the agreement.
Terms of service section 6.2.5, version 2.2 of 18 February 2026, says no customer data will be used, directly or indirectly, to train any foundational artificial intelligence models. Foundational is a qualifier. It bars training of foundation models and does not expressly address fine tuning or any other model of the vendor's own. Section 7.3.4 separately allows usage data, defined to exclude customer content, to be used to develop and improve the services.
The home page and help center go further, saying data is never used to train or fine tune any AI models and that this is contractually prohibited in all subprocessor agreements. That describes the vendor's contracts with its model providers rather than a term the customer holds.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Under section 4.5 of the agreement, Icertis returns Subscriber Data on written request in its then current format at no fee. It may destroy the data if no request arrives within five days of termination. Subscriber Data includes the output of processing. The agreement sets no shorter or configurable window for AI prompts and outputs during the term.
DPA section 16 requires destruction or return of personal data at the customer's election on termination, with destruction within twelve months in any case, and DPA section 3.3 confines processing to the customer's written instructions; the help center states that data passed through the AI integrations is not stored at the provider and not linked to any account. No zero-retention setting is stated. Nothing states how long prompts to PLAI or its outputs are retained inside the platform during the term, and the repository retains executed contracts by design.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Exhibit B of the agreement describes the product's own permission model. It sets out strict role based access control, with authorization implemented through the platform's own features, identity provider authentication, and audit logs capturing every user action with date and time. Section 2.4 makes the Subscriber responsible for determining access privileges, and single tenant deployment is available. The agreement does not describe how the Vera agents respect those permissions across a contract portfolio.
The help center states that role-based permissions control access down to document level, the home page lists advanced permissions and SSO with SAML, and the terms require an individual license per user. That is tenant and document level separation. Nothing describes how PLAI's retrieval respects those permissions when answering questions across the portfolio, and no document management system's access model is inherited because none is integrated.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 7.2 of the agreement permits disclosure of confidential information as required by law, regulation or court order. Unless legally prohibited, the receiving party must give the disclosing party prompt written notice before the disclosure and reasonable assistance in limiting it or obtaining a protective order. Confidential information is defined broadly, and Exhibit B states that Subscriber data is treated as confidential. Icertis publishes no transparency report.
Terms section 6.2.3 permits disclosure of confidential information, which includes customer data, when compelled by law or a binding order, and requires the receiving party, to the extent not prevented by law, to give the disclosing party notice of the proceeding and the compelled disclosure and to cooperate in seeking confidential treatment. DPA section 9.1 adds that the processor will inform the controller without undue delay of any contact from authorities, courts or regulators concerning the personal data it processes. No transparency report is published.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No primary law corpus is identified, and the product does not appear to hold one. Retrieval runs against the customer's own contract repository, templates and clause library, so the source material is the customer's own agreements and its provenance is theirs. The product pages and research library name no vendor supplied legal corpus, license basis or update cadence, which reflects a product built on the customer's own contracts.
The product is not built on a legal corpus: PLAI reviews contracts against the customer's own playbook, templates and Delegation of Authority and answers questions about the customer's own repository. No primary law source, license or update cadence is published.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Icertis is a contract lifecycle platform grounded in the customer's own agreements, with no case law research feature, so a citator falls outside its design. Its product pages and research library say nothing about whether authority carries a treatment signal or whether the product tracks subsequent history, and they name no commercial citator license.
The product does not retrieve or cite primary law, so no check of authority for subsequent history applies. Its output is redline assessments, drafts from templates, extracted metadata and answers about the customer's contracts.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
The product pages and research library do not describe what Icertis does when it cannot ground an answer, and mention no explicit no answer path or confidence signal shown to the user. The boundaries the vendor describes are limits a customer sets on what an agent may do. They are a permission concept, not a statement of what the system does when it does not know.
The home page and FAQ state that PLAI reviews every incoming redline against the playbook and flags what can be accepted, what needs to change and what needs legal escalation, and that anything outside the guardrails legal defines is routed to legal rather than handled. Nothing states what PLAI does when the playbook gives it no answer, as distinct from when a rule tells it to escalate.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin, which tracks court decisions worldwide involving AI generated hallucinated content and records the AI tool implicated where it is known, records no court order, opinion or disciplinary record naming Icertis. Published 2026 sanctions summaries and secondary sanctions trackers do not name it either. Icertis is a contract lifecycle platform with no case law research feature, so its output is very unlikely to reach a court filing as cited authority.
The AI Hallucination Cases database kept by Damien Charlotin holds no entry naming Miramis, Pocketlaw or Miramis Technologies AB. The product is a contract management tool that cites no legal authority.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Icertis publishes substantial annual research on AI adoption and trust in contracting, including the State of Contracting reports, and that research surveys practitioner sentiment. Neither the research library nor the blog, the news index or the product pages engages with a named ethics opinion or bar guidance, including ABA Formal Opinion 512 and state bar guidance. None of it addresses the professional responsibility rules that bind the vendor's legal buyers.
The terms and acceptable use policy address the advice line and require human review, but neither they, the home page nor the help center names an ethics opinion, bar rule or professional responsibility framework in any jurisdiction. The company is Swedish with a UK subsidiary, so its reference points would differ from the ABA opinion, and none from any jurisdiction is named.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Icertis frames its material around business outcomes rather than hours, such as growing revenue, controlling costs, reducing risk and ensuring compliance, and it claims faster drafting and more precise execution. Its product pages and research library describe no per matter record of work done with AI for fee purposes and give no guidance on billing, fees or client disclosure. The buyer is a corporate legal, procurement or finance function rather than a firm billing a client by the hour, so the savings are enterprise cost rather than billable time.
The buyer is an in-house legal department that bills no client, so the product sits outside a lawyer-to-client fee relationship. Savings claims are published: contract cycle time from 21 days to three to five, a six times efficiency improvement attributed to BabyBjörn's general counsel, and hours saved counters on the home page. Nothing addresses how AI-assisted work is recorded or disclosed on any bill, and no per-matter record of AI involvement is described, although every action carries an audit trail. No law firm is a named buyer segment.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A subprocessor list sits on the foundation page alongside the agreement, a Data Protection Addendum with standard contractual clauses, EU Data Act switching terms and an AI Acceptable Use Policy. The list on that page is dated 26 May 2026. The Trust Center adds SOC and ISO reports behind an access request.
The DPA appended to the public terms carries a current sub-processor and model provider list. Schedule 1 lists nine sub-processors by name, service, personal data processed and residency, with OpenAI and Google Cloud Vertex AI identified as the AI providers and every entry marked EU or EEA; DPA section 7 gives a 30-day objection window on additions and section 7.3 offers extracts of the sub-processor agreements on request.
The DPA is published without an agreement in place and is drafted as an appendix to be executed, so a firm's client could be given it directly.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Vera Composer tracks clause selection, template usage and edits for audit trails, Vera Redline supplies clause references with explanations, and the Fulfillment Agent logs a complete audit trail of its compliance decisions. These records preserve parts of contract drafting and review. A combined export identifying the specific model, all retrieved sources, and human verification of each generated passage is not described. The audit workflow serves commercial contracting, and Icertis describes no court filing certification process.
The home page states that approval routing and e-signing carry a complete audit trail on every action, that PLAI's redline review flags changes with reasoning, and that version history is kept in the negotiation workspace; that is a per-contract record of what the agent flagged and what a human approved. Nothing states that a record of the model used, the sources retrieved and the human verification can be exported per document, and the models are identified only as a family. The vendor does not address court disclosure, which is remote for a contract management tool.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Primary Law Corpus Provenance
- Good Law Verification
- Bar Guidance Alignment
In summary
Icertis
Icertis, founded in 2009 and based in Bellevue, Washington, sells Icertis Contract Intelligence, an enterprise contract lifecycle platform for buy side and sell side agreements. It covers authoring, negotiation, approval, execution, obligations, risk and analytics. It adds Vera Copilot, a contract intelligence engine and Vera agents that act within boundaries the customer sets. It runs on Microsoft Azure. According to the AI Legal Index, Icertis's agreement offers single or multi tenant hosting in a chosen Azure data center, and its liability terms carry an intellectual property indemnity, a twelve month fee cap and a published insurance schedule. It states 30 percent of the Fortune 100 as customers.
Miramis
Miramis, from Miramis Technologies AB of Stockholm with a London subsidiary, traded as Pocketlaw until February 2026. It now sells an enterprise contract lifecycle platform built around its AI agent, PLAI. Business teams draft from approved templates with CRM data and negotiate within guardrails legal sets. PLAI reviews redlines against the playbook, extracts metadata and answers questions across the repository, and signing is built in. According to the AI Legal Index, Miramis's terms bar training foundational models on customer data and name OpenAI and Google Vertex AI with EU residency. Its data processing agreement commits to breach notice within eight hours. Its pricing sits on a separate pricing page.
Questions buyers ask
Icertis vs Miramis: which is better for enterprise contract management?
It depends on what the company needs to read. Miramis publishes more about its AI, including its model providers, a training bar, European data residency and named customer counsel. Icertis publishes stronger deployment choices, including single tenant hosting and a FedRAMP cloud, and an insurance schedule. Large multinationals that need US government hosting have more to read from Icertis. From the AI Legal Index, based on each vendor's own published materials as of September 25, 2026. No vendor pays for placement.
Does Icertis use customer contracts to improve its AI?
Its agreement allows it. Section 5.2 of Icertis's subscription agreement lets it use subscriber data, which includes output, to maintain, develop and improve its service, including industry analysis, provided the data is not shared with third parties and the customer stays anonymous. An AI acceptable use policy is listed beside the agreement and may narrow this. Miramis's terms bar training foundational models on customer data. From the AI Legal Index, based on each vendor's own published materials as of September 25, 2026. No vendor pays for placement.
Where does Miramis process data?
In the EU or EEA. Miramis's data processing agreement lists nine subprocessors, including AWS, Azure, OpenAI and Google Vertex AI, each marked with EU or EEA residency, and states that processing takes place primarily there, with standard contractual clauses for anything outside. Its help center says data passed to the AI providers is not stored there. Icertis lets a customer pick its Azure data center. From the AI Legal Index, based on each vendor's own published materials as of September 25, 2026. No vendor pays for placement.
What was Miramis called before its rename?
Miramis Technologies AB traded as Pocketlaw from its founding until 11 February 2026, when it renamed to mark a move from a self serve legal platform for startups to enterprise contract lifecycle management. Its developer documentation is still hosted on a Pocketlaw domain, and a third party review reports that published pricing was withdrawn at the rebrand. From the AI Legal Index, based on each vendor's own published materials as of September 25, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Three points to weigh. Icertis's agreement grants it the right to use customer data, including AI output, to develop and improve its service while keeping the customer anonymous. That is a published term, and its separate AI acceptable use policy may narrow it. Miramis's training bar is worded for foundational models and does not address fine tuning or its own models. Miramis traded as Pocketlaw until 11 February 2026, and its pricing sits on a separate pricing page. Neither vendor reviewed this page.