Icertis vs Oneflow: how they compare in 2026
Icertis is a fit for large organizations linking contract intelligence to enterprise systems such as SAP, Microsoft, Salesforce and Workday. Its Vera direction builds on that enterprise contract environment. Oneflow offers a more defined web agreement workflow with direct CRM data exchange, collaborative editing and configurable review findings, plus a visible Business entry package. The important difference is the operational scale and integration context, not a claim that one AI can replace a lawyer. Icertis's agreement permits specified development and improvement uses of subscriber data, which includes output, while Oneflow explicitly prohibits customer data model training. In that difference between enterprise data permissions and a training ban, AI Legal Index identifies a procurement issue alongside the system design. Oneflow's generative AI exclusions and inconsistent beta review pricing also need to be reflected in the proposed scope.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Icertis offers Icertis Copilots, a contract intelligence engine that extracts clauses, obligations and risk, and Vera, an agent layer released across Engage, Operate and Analyze in 2026. The vendor says Vera acts autonomously within boundaries the customer sets. These sit on a contract platform for authoring, negotiation, approval, execution, obligation management and analytics, which runs without the models and was sold as Icertis Contract Management before the AI positioning. The rename to Contract Intelligence added an AI layer to that platform rather than rebuilding it.
AI supports several substantial contract tasks within Oneflow's wider platform. Write with AI drafts, edits and translates text inside an agreement; AI Extract imports participants, dates and duration into editable metadata. AI Review compares terms with a workspace playbook, and AI Insights aggregates the resulting risks across the portfolio. The premium package adds custom rules, dashboard widgets and a report for negotiation follow up. Electronic signatures, editable HTML agreements, permissions, approvals and renewal reminders continue to work without these models. Customers can disable AI, and several review capabilities remain in beta. AI therefore changes how users analyze contracts without replacing the underlying contract system.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Icertis describes a contract intelligence engine that extracts clauses, obligations and risk and turns them into queryable data, and an intelligence layer across the enterprise that it says understands business and industry context. It publishes no accuracy figure, hallucination rate, test set or evaluation, and does not describe how an output links back to a source the user can open. One Gartner Peer Insights reviewer says their organization has not been impressed with the Discovery tool AI.
Review findings connect to highlighted passages in the agreement, with controls for moving between them. Each finding carries the relevant playbook concept, configured feedback and example clause text. A separate view identifies required clauses that the review did not find, while portfolio charts open the corresponding contract list. This lets the reviewer compare a proposed concern with the actual wording and the organization's rule. Oneflow warns that generated text can misstate facts, numbers and law and recommends human correction. No reproducible accuracy study, error rate or jurisdiction specific evaluation accompanies these features. The contract highlighting supports source verification, not validation of legal authority.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Vera Composer gathers NDA or statement of work details through conversation, converts them into structured context, and assembles a draft using approved templates, clauses, and business rules. Vera Redline compares uploaded contracts with playbooks, exposes clause references and explanations, and proposes targeted changes for review. Exceptions escalate, while humans retain final legal judgment on complex or nuanced issues. Edits, clause selections, and reviewer actions are logged. The broader platform lets customers set boundaries for autonomous agents. Exact stop thresholds, configuration permissions, and correction procedures after an accepted error remain unspecified, although the review surface and human role are now explicit.
Administrators enable AI Review for a workspace and configure its playbook, including which clauses matter, which findings count as risks or issues, and what feedback appears. Role permissions separately control access to individual reviews and the Insights dashboard. Sent contracts receive continuing analysis; draft contracts require a manual review action. A person can inspect highlighted text, edit the playbook and use example wording when revising an agreement. The AI appendix advises human review before relying on output. No confidence cutoff, mandatory lawyer approval after an AI finding, or correction route for an already approved mistake is specified. Risk colors classify findings rather than stop execution.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Icertis publishes customer quotes that identify the customer by industry and revenue band rather than by name. Among them are an IT services company with more than $30 billion in annual revenue and a healthcare and biotech company with more than $1 billion. It says 30 percent of the Fortune 100 are customers, across more than 90 countries and millions of contracts. Gartner named Icertis a Customers' Choice in the 2025 Peer Insights Voice of the Customer report for CLM, with 93 percent of customers recommending the platform across 84 ratings. No published case study pairs a named customer with measured results.
Puzzel's Sales Operations Manager, Anette Johnsen, describes generating offers and contracts from Salesforce opportunities with items from related CPQ quotes. She identifies a concrete benefit of the HTML format: participants revise one agreement instead of uploading successive files before signature. Other named users include Systembolaget's Head of Indirect Sourcing, Tor Myhrman, and Hedin Bil's HR Business Partner, Elin Skoglund, who describe handling agreements and maintaining oversight. These accounts establish operational use across sales, procurement and HR. They do not isolate AI review performance or supply a measured error reduction, evaluation period and sample for Oneflow's current AI packages.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The SaaS Subscription and Services Agreement sets out role based access control, identity provider authentication, audit logs of every user action, encryption at rest and in transit, and a single tenant option. Section 4.5 returns Subscriber Data on request and permits destruction if it is not requested within five days of termination. Section 5.2 lets Icertis use Subscriber Data, including output, to maintain, develop and improve the service, provided the data is not shared with third parties and the Subscriber stays anonymous. The agreement does not address attorney client privilege or work product, or say how the Vera agents respect user permissions. A 2017 company news item describes storage on GDPR compliant cloud infrastructure with encryption at rest and in transit. Icertis also links a Trust Center from its site.
The AI appendix expressly prohibits Oneflow from training any AI model on customer data and takes precedence over conflicting general terms for AI features. Ordinary service confidentiality continues while information remains confidential, with restrictions on compelled disclosure. There is a consequential exception: the generative AI section excludes Oneflow's contractual confidentiality obligations along with liability, indemnities and service levels. Review, Insights and Extract have a separate processing section tied to the DPA. Workspace permissions and optional provider controls support access management, but attorney client privilege and work product receive no specific undertaking. The contract therefore requires attention to the exact AI functionality being enabled.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Icertis sells the platform across legal, procurement, sales, finance and HR, where it handles NDAs, service agreements and HR paperwork alongside commercial contracts. Its AI drafts, redlines and negotiates for all of those users. The product pages, company section and research library take no position on where a tool ends and legal advice begins, and say nothing about competence or supervision duties. They set no jurisdiction limits, although Icertis operates in more than 90 countries. The human first framing describes how the product is designed rather than a position on professional responsibility.
Oneflow's AI appendix says output is not legal advice, legal conclusions, recommendations about legal rights or an application of law to a customer's circumstances. It advises human review because generated content can misstate law as well as facts. A separate UK article maps solicitor responsibilities to SRA standards, confidentiality, client communication and supervision, and describes practical review and pilot controls. North American terms also prohibit treating the platform as a substitute for an attorney. The product nevertheless serves sales, HR and other users without legal qualifications. No comprehensive jurisdiction by jurisdiction set of product restrictions or lawyer competence program is supplied.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Icertis calls itself AI native and human first, says its agents operate within boundaries the customer sets, and publishes annual research on buyer concerns about AI. That research reports that 55 percent of contracting leaders cite data output quality as a significant concern and 44 percent lack sufficient trust in autonomous AI. The product pages and research library describe no AI governance framework, no AI management certification such as ISO 42001, no named owner of model governance and no testing before release. They say nothing about uneven output across matter types, parties or populations.
Oneflow promotes human accountability and warns against automation bias in its guidance for UK legal teams. It recommends evaluating missed issues, overrides and review quality rather than relying only on speed, and says its AI performs best in English and Swedish. These are useful limits and principles for customers designing a pilot. The public material does not identify an accountable AI governance owner, publish a model release evaluation, or report bias and performance differences across languages, contract types or populations. General ISO security controls and a list of security policies concern operational protection; they do not describe a separate AI testing and governance program.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Section 4.5 of the agreement returns Subscriber Data on request at no fee and permits destruction if it is not requested within five days of termination. Exhibit B sets out strict role based access, identity provider authentication with multifactor support, audit logs of all user actions, encryption at rest and in transit, Azure network security groups and threat monitoring. It also commits Icertis to notify the Subscriber of any breach resulting in loss or unauthorized disclosure of Subscriber Data, under a documented incident process. Section 6.1 bars sale of personal data and its combination with other sources, while section 5.2 permits use of Subscriber Data to develop and improve the SaaS. A List of Standard Sub-Processors, in a version dated June 2023, is published on the foundation page.
Contract data is encrypted with AES 256 at rest and TLS 1.2 in transit. Customers configure permissions and retention policies; administrators can disable optional providers or AI features. Global DPA terms require breach notification without undue delay, while the North American DPA specifies 48 hours. Daily database snapshots last seven days, and system and authentication logs last 90 days. The DPA permits limited residual backups after deletion without fixing that period. Generative AI history can follow provider terms, while the product page promises removal of temporary review and import data. That leaves no single, specific retention schedule for every prompt and output.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Section 9.1 of the agreement gives a defense and indemnity for third party intellectual property claims, for claims by Icertis subcontractors or personnel, and for gross negligence causing injury or property damage. It states an exclusion for Subscriber Data. Section 10.1 excludes consequential loss, and section 10.2 caps each party at the amounts Icertis received in the preceding twelve months. Section 8.2 warrants noninfringement, professional performance and material conformity to the documentation, with a correction remedy and a termination right. Section 10.4 commits Icertis to carry commercial general liability cover of $1 million per occurrence and $2 million in aggregate. It adds technology errors and omissions cover including cyber liability of $5 million, umbrella cover of $5 million and employer's liability. The cover comes from a carrier rated A minus, runs for the term and one year after, and a certificate is available on request. The agreement gives AI output no separate warranty. An AI Acceptable Use Policy sits on the foundation page as an addendum to the agreement.
Ordinary global service terms include an intellectual property defense obligation, a material performance warranty and a general cap based on 12 months of fees. Those protections do not carry through unchanged to AI. The appendix supplies AI output as is, disclaims warranties and excludes all liability and indemnification undertakings for generative AI functionality, together with confidentiality obligations and agreed service levels. It also permits specified AI suspensions or termination without reimbursing fees. North American terms contain the same generative AI exclusion. A wrong clause, inaccurate summary or reliance on generated advice has no specific affirmative AI remedy in these published terms.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Icertis publishes a Native Integrations page with prebuilt adapters for SAP, Microsoft, Salesforce, Workday, Adobe Sign and DocuSign, each described by what it moves. The SAP Ariba adapter syncs procurement contracts, line items and suppliers, and the SAP S/4HANA adapter brings buy side supplier master data into the platform. For ERP and finance, adapters for Microsoft Dynamics 365 Finance and Operations and for Workday Financials sync procurement contracts, suppliers and financial data. The Salesforce CRM and CPQ adapter creates contracts from accounts, opportunities and quotes, with two way sync of deal and pricing data, and a Dynamics 365 Sales adapter keeps contract and sales data in step. The Adobe Sign and DocuSign adapters return signed agreements and audit trails to the platform. Microsoft Teams, Microsoft 365 for the web and Outlook connections cover collaboration, and SAM.gov and federal clause adapters serve public sector work. Licensed public APIs and connections to OpenAI, Claude, Microsoft Copilot and SAP Joule agents round out the list. The page does not describe setup or what an administrator configures, and it names no document management or identity connector. The platform runs on Microsoft Azure, with Microsoft as a strategic partner, and its named competitors include SAP Ariba and DocuSign CLM.
The Salesforce integration creates interactive contracts from opportunities and transfers contact, company and opportunity data into them. Its configurable sync sends data from Salesforce objects into Oneflow and returns contract values to Salesforce. Product tables can reflect price books or CPQ quotes, while workflows map contract stages back to pipeline stages. Engagement events and status changes appear in the Salesforce timeline, and returned contract data supports dashboards. Oneflow identifies separate setup guidance for older and newer integration versions and compatibility with Professional edition upward. HubSpot, Dynamics 365 and other CRM connections complement this workflow; Salesforce and Dynamics can require premium integration charges.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Exhibit B of the SaaS Subscription and Services Agreement states that the platform is hosted on Microsoft Azure and that the Subscriber may select the Azure data center at the outset of the subscription. Production backups sit on geo replicated Azure storage. Exhibit A-2 distinguishes single tenant subscribers, who schedule their own upgrades and receive wider version support, from multitenant subscribers on the automatic upgrade calendar, so both tenancy models are offered. A FedRAMP government community cloud is listed separately. The agreement does not say where model inference runs.
Production infrastructure uses AWS availability zones in Ireland, with document replication and backups in Sweden. Oneflow's AI FAQ broadly describes data as remaining in the EU, and Insights Premium is described as running within Oneflow's own EU infrastructure. The published subprocessor table gives a more varied picture: optional Legly review operates in Germany, optional OpenAI extraction in the United States, and Postmark email processing also in the United States. Administrators can disable optional services. The public descriptions do not fully reconcile these routes or map every AI function to a processing region. No on premises deployment is offered in the published package descriptions.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Exhibit B of the SaaS Subscription and Services Agreement states that Icertis is ISO 27001, ISO 27017 and ISO 27018 certified, holds SOC 2 Type 1 and Type 2 certifications and complies with ITAR. It manages risk under the ISO 27001 framework, commissions regular third party vulnerability assessments and penetration testing, encrypts data at rest with AES-256 and supports customer managed keys in Azure Key Vault. The agreement names no auditor, coverage period or self serve route to the reports. Icertis links a Trust Center from its site.
A public certificate issued by Qvalify covers Oneflow AB's digital solution for contract automation under ISO 9001:2015, ISO 14001:2015 and ISO 27001:2022. It was issued on June 28, 2024 and remains valid through June 30, 2027, identifying the Stockholm organization and its registration number. A June 2026 statement of applicability lists the security controls and their implementation status. The security center separately identifies SOC 1 Type 1 and SOC 2 Type 1 reports issued by Grant Thornton, available under NDA. Those reports concern control design; neither is identified as a Type II examination of operating effectiveness over a stated period.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
Icertis names Microsoft as a strategic partner and Azure as its platform, and a Microsoft published customer story records Icertis monitoring Azure OpenAI deployments, which places Azure OpenAI in the stack. Its integrations page lists interoperability with OpenAI, Claude (Anthropic), Microsoft Copilot and SAP Joule agents. Neither source says which models power the Copilots, the contract intelligence engine or Vera, or which model serves which task. The agreement and product pages do not say where models run or commit to notifying customers when the model supply chain changes. A List of Standard Sub-Processors, dated June 2023, sits on the foundation page.
The subprocessor list identifies Legly AB for contract review in Germany and OpenAI for extraction in the United States, alongside AWS infrastructure in Ireland and Sweden. Both AI suppliers are optional and controlled through account settings. The AI appendix directs customers to their Data Management page for the current generative model suppliers and their terms. It does not publish model versions or a complete function to model map. DPA provisions require reasonable advance notice of subprocessor changes to the customer's designated email address and allow a 14 day objection. That process concerns suppliers, without promising notice of every underlying model change.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Icertis publishes no pricing page, rate, unit of charge or tier structure. Every commercial path on its site ends in a demo or contact request, and there is no free trial or self serve entry point. No third party pricing figure is published either.
Business starts at $292 a month, billed annually, including five users; Enterprise has ten users and a custom quote. Business includes writing, extraction and summary features. Standard AI Review and Insights have conflicting public treatment: the pricing page marks paid beta additions, while September help guidance says they are included in Enterprise during beta. Insights Premium is explicitly a paid addition for Business and Enterprise. SMS, identity verification, premium integrations and enhanced support can cost more. A 14 day trial needs no card. Implementation has no published amount, and global annual renewals can increase by the greater of 5 percent or Swedish CPI.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Icertis sells to large enterprises, says 30 percent of the Fortune 100 are customers across more than 90 countries and multiple languages, and covers buy side and sell side agreements rather than one direction. The vendor's own research publishes industry breakouts for public sector, healthcare and life sciences, and banking and insurance, among others. Functional coverage spans legal, procurement, sales, finance and HR. Icertis does not say which organization sizes, contract types or practice areas the platform is not built for. Third party reviews say small and most mid market businesses will find it more platform than they need.
Legal, procurement, sales, finance and HR teams can create and manage agreements in Oneflow. Legal users configure review rules and approve terms; business teams use reusable templates and CRM data for offers, sales agreements and employment documents. Named customers span telecoms, retail, recruitment and public sector purchasing. UK guidance also addresses solicitors using AI for commercial contract review, bringing professional duties into the intended audience. AI is optimized for English and Swedish, with variable results in other languages. The product does not supply a jurisdiction specific research corpus, and its coverage statements do not define supported litigation work or every category of legal agreement.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Section 5.2 of the SaaS Subscription and Services Agreement licenses Icertis to use Subscriber Data to provide the SaaS. It also lets Icertis use Subscriber Data to maintain, develop and improve the SaaS, including creating industry relevant analysis, provided the data is not shared with third parties and the Subscriber stays anonymous. Subscriber Data is defined to include the output of processing. The clause does not name model training. An Artificial Intelligence Acceptable Use Policy is listed on the foundation page as an addendum to the agreement.
The AI appendix forbids Oneflow from using customer data to train any AI models and overrides conflicting general terms for AI issues. Inputs and attributable outputs fall within the customer data definition. The general service license permits improvement and anonymized analysis, and AI feedback may improve accuracy, but those clauses do not remove the express training ban. The product FAQ also says underlying models do not train on customer data.
Separate provider processing, retained history and the generative AI confidentiality exclusion remain relevant to handling client material.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Under section 4.5 of the agreement, Icertis returns Subscriber Data on written request in its then current format at no fee. It may destroy the data if no request arrives within five days of termination. Subscriber Data includes the output of processing. The agreement sets no shorter or configurable window for AI prompts and outputs during the term.
Oneflow permits customers to set retention policies for stored contracts, and its AI page says temporary import, review and Insights data is removed after use. Generative AI has a different contractual provision: input questions and output responses may remain as history under the model supplier's current terms. No uniform period covers that history or every provider copy. Daily database snapshots last seven days, system logs last 90 days, and residual backups after termination have no precise DPA deadline. Contract deletion therefore cannot be treated as an immediate purge of all AI processing records.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Exhibit B of the agreement describes the product's own permission model. It sets out strict role based access control, with authorization implemented through the platform's own features, identity provider authentication, and audit logs capturing every user action with date and time. Section 2.4 makes the Subscriber responsible for determining access privileges, and single tenant deployment is available. The agreement does not describe how the Vera agents respect those permissions across a contract portfolio.
Workspace roles control access to contracts, and Oneflow provides distinct permissions for AI Review and the Insights dashboard. Administrators enable review for selected workspaces and can disable AI features or optional suppliers. These controls can support departmental separation and limit who sees review results. The descriptions do not specify how retrieval enforces every contract permission within a workspace, how restrictions propagate to generated summaries, or how a law firm's matter wall follows an AI request. Permission controls alone do not establish a complete ethical wall mechanism for confidential client matters.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 7.2 of the agreement permits disclosure of confidential information as required by law, regulation or court order. Unless legally prohibited, the receiving party must give the disclosing party prompt written notice before the disclosure and reasonable assistance in limiting it or obtaining a protective order. Confidential information is defined broadly, and Exhibit B states that Subscriber data is treated as confidential. Icertis publishes no transparency report.
Global confidentiality terms require reasonable prior notice when disclosure is legally compelled, unless notice is prohibited, and reasonable assistance at the customer's expense in seeking protection. That gives the customer an opportunity to contest or narrow a request involving ordinary confidential service data. The AI appendix expressly removes contractual confidentiality obligations for generative AI functionality, so the same protection should not be assumed across every AI route.
No transparency report accompanies the commitment. North American and global agreements need to be matched to the contracting entity and enabled services.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Icertis identifies no primary law corpus, and the product does not appear to hold one. Retrieval runs against the customer's own contract repository, templates and clause library, so the source material is the customer's own agreements and its provenance is theirs. The product pages and research library name no vendor supplied legal corpus, license basis or update cadence, which reflects a product built on the customer's own contracts.
Oneflow's review and portfolio analysis work with the customer's agreements and configured playbook concepts. Example clauses come from the organization's rule setup, and drafting can use selected text as input. No catalog of legislation, reported decisions or licensed legal commentary is supplied for these features. Naming a model provider does not identify the legal sources in its training data or their licensing terms.
The UK educational articles link professional guidance, but those links do not constitute a legal research corpus inside the product.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Icertis is a contract lifecycle platform grounded in the customer's own agreements, with no case law research feature, so a citator falls outside its design. Its product pages and research library say nothing about whether authority carries a treatment signal or whether the product tracks subsequent history, and they name no commercial citator license.
Highlighted review passages let a user inspect contract language, not whether a judicial decision remains authoritative. Oneflow has no published citator connection, treatment history service or automated check of legislation's current status. Teams maintain their own playbooks, including preferred and fallback clauses, so changing a rule after a legal development remains an organizational responsibility. The appendix warns that AI can generate incorrect law and recommends human review. A portfolio risk chart or missing clause flag does not establish that the underlying legal proposition remains valid.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
The product pages and research library do not describe what Icertis does when it cannot ground an answer, and mention no explicit no answer path or confidence signal shown to the user. The boundaries the vendor describes are limits a customer sets on what an agent may do. They are a permission concept, not a statement of what the system does when it does not know.
The AI Review interface separates findings from a missing clauses view. That view identifies playbook concepts absent from the agreement, giving the reviewer an explicit negative result instead of merely omitting a match. Red and yellow labels distinguish issues from risks; they are not numerical confidence estimates. Oneflow warns that generated facts and law can be wrong, but does not publish a general abstention rule for drafting or summaries. Missing clause handling is described for review, without promising that every unsupported question will be refused.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin, which tracks court decisions worldwide involving AI generated hallucinated content and records the AI tool implicated where it is known, records no court order, opinion or disciplinary record naming Icertis. Published 2026 sanctions summaries and secondary sanctions trackers do not name it either. Icertis is a contract lifecycle platform with no case law research feature, so its output is very unlikely to reach a court filing as cited authority.
Damien Charlotin's AI Hallucination Cases database contained no entry naming Oneflow as of October 16, 2026. The result covers the database's reported court incidents, not every private use of the product or every inaccurate contract response. Oneflow itself discusses court examples involving generic AI tools in educational material; those examples do not identify Oneflow as the tool involved. Contract drafting and risk analysis can still produce incorrect law, which the AI appendix expressly warns about. The absence of a named incident provides no accuracy guarantee.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Icertis publishes substantial annual research on AI adoption and trust in contracting, including the State of Contracting reports, and that research surveys practitioner sentiment. Neither the research library nor the blog, the news index or the product pages engages with a named ethics opinion or bar guidance, including ABA Formal Opinion 512 and state bar guidance. None of it addresses the professional responsibility rules that bind the vendor's legal buyers.
Oneflow's UK contract review guidance maps SRA standards and conduct duties to human supervision, confidentiality, client transparency and practical controls. It also discusses insurance, data protection and the legal team's responsibility for final judgment. This is a jurisdiction specific mapping with suggested review steps, rather than a generic statement that lawyers remain responsible. It is vendor guidance, not regulator approval or an independent finding of compliance. The mapping does not establish equivalent coverage for every jurisdiction in which Oneflow sells its platform.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Icertis frames its material around business outcomes rather than hours, such as growing revenue, controlling costs, reducing risk and ensuring compliance, and it claims faster drafting and more precise execution. Its product pages and research library describe no per matter record of work done with AI for fee purposes and give no guidance on billing, fees or client disclosure. The buyer is a corporate legal, procurement or finance function rather than a firm billing a client by the hour, so the savings are enterprise cost rather than billable time.
The vendor's UK AI review material addresses solicitors as well as internal legal departments and promotes faster review with retained professional judgment. Its product pages also describe reducing routine contract work and administrative effort. No accompanying procedure explains how a firm records AI time, adjusts a client invoice, discloses savings or passes through Oneflow charges. Subscription pricing is the buyer's software cost rather than a client billing policy.
Because the audience includes lawyers serving clients, the time savings claims cannot be treated solely as an organization's internal operating expense.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Icertis publishes a subprocessor list on its foundation page alongside the agreement, a Data Protection Addendum with standard contractual clauses, EU Data Act terms and an AI Acceptable Use Policy. The list on that page is dated June 2023.
Oneflow supplies a public DPA, global and North American service terms, an AI appendix and a subprocessor table with functions and processing locations. Optional AI suppliers include Legly and OpenAI, and administrators can control optional services. A public ISO certificate and statement of applicability support security diligence; SOC reports require an NDA. These materials help counsel explain data handling to a client.
They do not form a dedicated client AI disclosure package, and the generative AI confidentiality exclusion and conflicting regional descriptions require specific attention in any outside counsel approval process.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Vera Composer records template usage, clause selection, and edits, while Vera Redline logs reviewer actions and supplies clause references with explanations. These records preserve parts of contract drafting and human review. A combined export identifying the specific model, all retrieved sources, and human verification of each generated passage is not described. The audit workflow serves commercial contracting and does not establish a court filing certification process.
AI Insights supports an export of portfolio analysis, and reviewers can inspect the contract passages associated with a playbook finding. Insights Premium adds an action report for internal discussion and negotiation. Enterprise also includes an account audit log, while signing workflows maintain transaction records. The published export instructions do not establish a complete record of model identity, prompt, output and human edits for each AI action.
These are useful contract administration records, but no court disclosure template or complete model provenance export is described for a later filing.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Primary Law Corpus Provenance
- Good Law Verification
Which one fits
Choose Icertis if
- Contracts must connect to a broad SAP or Microsoft enterprise program.
- The legal project includes procurement, finance and sales system coordination.
- Enterprise contract intelligence is the main platform requirement.
Choose Oneflow if
- The first rollout centers on editable web agreements and CRM data.
- A published five user starting package helps establish the budget.
- Reviewers want visible playbook concepts beside highlighted agreement text.
In summary
Icertis
Icertis connects enterprise contract data and AI capabilities to major business platforms. The service agreement covers subscriber data, output and permitted improvement uses within its broader contract intelligence environment.
Oneflow
Oneflow provides interactive contracts with approvals, signatures and linked CRM values. Its review workspace highlights clause issues and missing provisions, with portfolio charts based on the organization's playbook.
Questions buyers ask
Does Icertis's improvement license necessarily mean raw contracts train shared models?
The published permission covers specified subscriber data development and improvement uses. It should not be expanded into an unsupported claim that every raw agreement trains a shared model. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
What does Oneflow's Salesforce connection actually move?
It supports object values into contracts and back, quote or price book items in product tables, engagement events and contract stages reflected in the sales pipeline. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Can Oneflow's Business price estimate an Icertis deployment?
No. Oneflow's $292 monthly equivalent describes a specific five user package on annual billing. Icertis enterprise scope, integrations and commercial terms require their own proposal. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
What separates the integration decisions for Icertis and Oneflow?
For a project spanning major enterprise systems, AI Legal Index highlights Icertis's SAP, Microsoft and wider business ecosystem. Oneflow's comparison rests on a more specifically described CRM to agreement workflow, rather than an assumption of identical enterprise scope.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Icertis enterprise licensing and Oneflow's public Business package are different commercial units.