iManage vs NetDocuments: how they compare in 2026

The FAQ on the AI page states that Mailbox Assistant, AI Services and Ask iManage are not included in a standard cloud subscription and must be purchased as additional products, and that iManage AI is available only on the cloudimanage.com endpoint, with customers still being moved there. The platform underneath is a document and email management system with security, governance, records, conflicts, knowledge search, transaction management and workflow products, sold for decades and bought for that. AI Enrichment classifies and extracts at scale and Ask iManage answers questions from the repository; without both, the document management system is unchanged.

NetDocuments is a cloud document and email management system sold for twenty five years. The ndMAX suite adds a Legal AI Assistant, AI Search, Tabular Review, an App Builder and a library of ready made legal apps. Smart Answers, which began rolling out to ndMAX Enterprise customers on 31 March 2026, answers questions from the firm's repository with citations. The vendor frames this as bringing AI to the content rather than taking content to AI. Its press material says more than 800 firms began using the AI capabilities in 2025 and over forty percent of new customers choose AI at purchase. Without the models, the document management, email management, search, security and collaboration product remains, which is what most of the 7,000 organizations bought.

Ask iManage works in three steps. It interprets intent and context from a plain language prompt rather than keywords, identifies the most relevant material within iManage Work, and generates an answer anchored with citations so users can verify the sources. The product page states that answers are backed by citations to the firm's own work and that documents never leave the platform. It also claims that outputs are grounded rather than hallucinated because the system draws only from real documents. No accuracy figure, test set or evaluation of any kind is published. The product cites the firm's own files, not reported authority, so checks on case citations do not apply.

The Legal Context Engineering Benchmark, published 18 August 2026 by the VP of Product, reports quality scores out of 100 for the vendor's own AI answers across three model tiers. Without the Legal Context Graph they are 64.0, 67.4 and 73.9; with it, 65.1, 69.0 and 75.4. Correct answer counts out of 300 and the cost of a correct answer are also given. The test set has 300 questions across ten real matters, five transactional and five litigation, built from public filings and court dockets partly outside the models' training cutoff. It covers 874 documents and about sixty million characters, with nothing synthetic, six named question types including Unanswerable, and a rubric for each question. Citations are checked automatically against the documents, with human spot checks. A worked example shows the product's own answer failing all three criteria without the context layer and still failing one with it. The method is published for firms to rerun. It is the vendor's own benchmark, not third party validation, and an appendix with per matter scorecards is published with it.

Every answer carries citations the user can open to verify the source, all AI interactions stay inside the governed platform with native enforcement of permissions and information barriers, and the vendor describes the result as explainable and auditable in regulated settings. No published material says what the system does without a lawyer, any threshold at which it stops, or what happens after an output is wrong. The May 2026 playbook analysis release describes the feature applying a firm's positions automatically to every contract review, without saying where review sits in that loop.

The vendor says the best AI apps run automatically in the background based on a user's actions, and MCP connectivity lets external agents run workflows across systems. On the oversight side, answers carry citations a lawyer can open, and Exhibit B commits to document level activity logs reviewable for ninety days. Administrators control which users and applications reach what through the Customer Service Account. The benchmark report tells readers to read some of the answers themselves before believing any of the numbers. Nothing on the Legal AI page, in the benchmark report or in the agreement says the models work alongside a supervising lawyer, names the point at which an app acts without one, or says what happens when an output is wrong. The Legal AI page also carries an Our Approach to AI video.

The vendor's release of 12 June 2025 reports that Rio Tinto's legal function replaced a SharePoint based system with iManage Work 10, Threat Manager and Share. It covered more than 200 users across Australia, Singapore, the United Kingdom and North America, and 4.5 million documents were migrated. User engagement reached 80 percent within four months of going live, with half the department classified as active users. A named Digital Transformation Lead is quoted. Those figures measure the document management deployment, and the same release records Ask iManage as something the customer is exploring, not running. Statements about the AI come from the Director of Information Technology at Jones Walker LLP on the January 2026 release, a manager at Rio Tinto in trade press, and a Senior Associate at Simpson Grierson describing a trial. No figure attaches to an AI outcome, and no method is published for the 80 percent.

On the Legal AI page, Jared Gullbergh of Buchanan says a single AI app was calculated to save over 1,500 hours of work a year while producing better work product. Charly Duffy of Coghlan Duffy speaks on the App Builder, and Jeff Sabado, Director of Knowledge Management at Davis Wright Tremaine, says the tools already respect the firm's client and matter based security and ethical walls. Company figures are published without reference to any deployment: more than 7,000 organizations served, more than 800 firms starting to use the AI in 2025, over forty percent of new customers choosing AI at purchase, and more than 150 integrations. No deployment is dated, and the basis for the 1,500 hour figure is not published.

Customer Data is the customer's Confidential Information under section 6.1 and must be safeguarded in perpetuity under 6.3(c)(ii), longer than the five years the agreement gives other confidential information. The customer remains sole owner under 5.2. The AI page states that by default neither iManage nor its third party model providers use customer data to train or retrain models, that data is encrypted and that iManage does not have access to the underlying content. Security Policy Manager is sold as a product for information barriers, and the January 2026 release states that AI interactions carry native enforcement of permissions, information barriers and security policies. Retention and deletion are set out in the DPA, and Exhibit B records that each customer's data is logically separated. Privilege and work product are not addressed in the agreement or on the AI pages. The training promise is prefaced "by default", with an opt in whose scope is not published.

Under the agreement, Customer Repository Data is confidential and NetDocuments disclaims ownership of it (5.2.1). Use is limited to providing the Services, supporting third party applications the customer selects, help desk support the customer starts, and legal demands (5.2.2). Ethical walls are a documented product with access controls at user, document and workspace level, and the vendor says the AI works inside a firm's existing permissions and walls. The ndMAX FAQ says inputs and outputs are not kept beyond producing the answer and are not used to train the model. The position on the model provider is explicit, including an agreement with Microsoft that keeps customer content out of abuse monitoring. Privilege and work product are not addressed in the agreement or on the product pages. The training statement covers the LLM rather than NetDocuments' own use.

The product answers legal questions from a firm's documents, extracts clauses, compares redlines and applies contract playbooks. The Cloud Services Agreement addresses acceptable use, warranties, indemnities and liability and says nothing about advice, competence or supervision, and its warranty disclaimer at 8.5 does not say what the product is and is not. The AI and Ask iManage pages carry no disclaimer, and the website terms of service govern the website, not the product. The agreement confines use to Authorized Users for the customer's internal business operations, every segment page addresses law firms, corporate legal, compliance and other professional functions, and there is no consumer surface.

The product's AI apps analyze NDAs, assess contract risk, produce judge analytics and answer questions about a matter. The Software as a Service Agreement covers use restrictions, AI restrictions on the customer, warranties and liability without touching advice, competence or supervision. Section 9.4 disclaims that results will meet any requirement, which is a warranty disclaimer, not a statement of what the product is and is not. The Legal AI, App Builder and Ethical Walls pages carry no disclaimer. The audience is clear: every segment page addresses law firms, corporate legal departments and public sector legal teams, and the agreement limits use to internal business purposes by named users, so there is no consumer surface. NetDocuments also publishes Terms of Use.

The AI page states that the platform approach lets organizational data be used securely, responsibly and ethically, whether by iManage or a third party. The vendor publishes an ESG report and a diversity statement, and trade coverage records the appointment of a Vice President of AI Engineering in 2026. Outside the trust center, nothing published names who inside iManage is accountable for AI governance, describes what is tested before an AI capability ships, or discloses any finding about uneven output across matter types or populations. No governance standard such as ISO 42001 is published. The trust center is hosted on Vanta.

The Legal Context Engineering Benchmark is a signed technical report by the VP of Product describing what is tested and how. It includes a test harness that compares the two tool setups before a run and refuses to proceed if they differ in anything but the capability under test. Citations are checked automatically against the source documents, with human spot checks, and the method is published for others to apply. The report also states its own limits. It does not yet measure change over a matter's life, it withholds the context build cost because that varied about sixfold across ten matters, and it was drafted with AI assistance. No responsible AI framework, policy or standard such as ISO 42001 is published. Nobody is named as accountable for AI governance, as distinct from authoring the benchmark, and nothing addresses uneven output across matter types or populations. An appendix PDF with per matter scorecards accompanies the report.

The DPA commits to notifying the customer of a Security Incident without undue delay and in any event within 48 hours, and to helping with the customer's own notification duties. The customer can access, extract and delete Customer Data at any time during the term. After expiry the vendor keeps it for 90 days so the customer can extract it, then disables the account and deletes within 30 days. Backups are never held beyond 90 days. Exhibit B sets out AES-256 encryption at rest, least privilege access and logical separation of each customer's data. It also commits to annual independent assessment against ISO 27001 and ISO 27017, annual third party penetration testing and Tier 3 or better data centers. The vendor keeps a subprocessor list and gives 60 days' notice before a new one touches customer data. Customers have 30 days to object, with termination and a pro rata refund if the objection is not resolved.

Under Exhibit B of the Software as a Service Agreement, NetDocuments must report confirmed Unauthorized Access to the customer without unreasonable delay and within 24 hours, with a root cause analysis and mitigation plan. Customer Repository Data is encrypted in transit and at rest, and access follows least privilege, removed when employment ends. Independent penetration tests run at least twice a year, with monthly internal and external vulnerability scans. Document and administrative activity logs are reviewable by the customer for ninety days, and NetDocuments keeps log information for at least a year. Data is stored across two or more geographically separate data centers, with a two hour recovery point and six hour recovery time. Under section 7.4 the customer is responsible for export, and NetDocuments may destroy remaining data thirty days after the term ends. Section 12.2 permits Common Subcontractors and promises notice of material changes without naming them, so no subprocessor list is published; Microsoft, for the AI, is the only processor named anywhere.

Section 9.1 gives a defense and indemnity against third party claims that the Services infringe intellectual property rights, with three named exclusions. Section 9.4 sets out the remedies: procuring the right, modifying or replacing the service, or terminating with a refund of the prepaid balance. Section 10.2 caps each party at the greater of twelve months' fees or fifty thousand US dollars. Section 10.1 excludes consequential loss for both parties, and 10.3 lifts both the exclusion and the cap for fraud, for the indemnities, for negligence causing death or personal injury and for willful misconduct. Section 8.3 warrants performance by qualified personnel to industry standards, that the Cloud Services are free of harmful code, and that they will perform substantially in accordance with the documentation. Exhibit A adds a 99.9 percent availability commitment with service credits, and a right to terminate where availability falls below 99.0 percent in three months of any six. No insurance is stated, and nothing addresses liability for a wrong AI output specifically.

Section 11.1 of the Software as a Service Agreement gives a defense and indemnity against third party claims that the Services infringe intellectual property, with three named exclusions and modify, license or terminate remedies at 11.3.3. Section 10.3 caps each party at the annualized subscription fee paid or payable at the time of the event, with indemnities carved out of the cap. Section 10.1 excludes indirect and consequential loss, and 10.4 preserves liability for death or personal injury caused by negligence and for fraud. Section 9.2 warrants professional and competent performance, and Exhibit A publishes a 99.9 percent availability target with graduated service credits. No insurance is stated. Section 10.1 also removes every liability limit for a customer's breach of the AI Restrictions in section 3.5, so NetDocuments may recover lost profits and all indirect and consequential damages without a cap, while the customer's own recovery stays capped at a year of fees.

A Microsoft partnership page describes a plugin connecting Microsoft 365 with iManage while keeping the repository as the single source of truth. A Model Context Protocol connection is sold as an open standard that lets AI and legal technology tools reach iManage content without custom connectors, and the January 2026 release states that the same underlying AI services expose content to third party applications through MCP with permissions and information barriers enforced and content never leaving the platform. Access software (ndOffice equivalents, mobility clients) is defined in the agreement, and the Rio Tinto release describes API integration between iManage and that customer's own digital legal hub with iManage as the core content layer. The agreement says third party products and any data transfer to them are between the customer and that provider, with no iManage warranty. The partnership page, the agreement and the release do not set out what moves in which direction. iManage also publishes an MCP product page and a partner directory.

The vendor says the platform integrates with more than 150 technologies, including Microsoft 365, Teams and DocuSign, and publishes an App Directory and partner locator. It ships ndOffice and mobile access software defined in the agreement. In 2026, Model Context Protocol connectivity let external AI applications and agents reach NetDocuments content and run workflows without downloads or manual transfers. The vendor names ChatGPT, Claude, Claude Cowork and its legal plugin, Microsoft Copilot, Perplexity, Google Gemini Enterprise, Harvey and Legora, and says this works within existing permissions, ethical walls and audit controls with no content leaving the platform. The agreement sets out API access: it is not included in the subscription, is granted on request after registering an application, may not be shared, and may carry further terms. The Legal AI page, the press material and the agreement do not say what moves in which direction for each integration, and NetDocuments also publishes support documentation.

Region is a defined term in the SLA, availability is measured per region with service credits, and DPA 12.4 states that all Customer Data is stored in the geographic region set out in the applicable Order. The same clause discloses that iManage may provide the Services from other regions, naming the United States, the United Kingdom, Canada, Australia and India, so iManage personnel there may have access to Customer Data. DPA 12.1 warns that this applies even where the customer has agreed to hosting in the EEA or the United Kingdom. Transfers out of the EEA and UK run on the 2021 Standard Contractual Clauses with the UK Addendum, incorporated in Schedule 1. Exhibit B describes tenancy as logical separation of each customer's data. The agreement does not list the regions a buyer can choose; they are set in the Order, and iManage publishes a separate Cloud page. iManage AI runs only on the cloudimanage.com endpoint.

Services Region is a defined term in the Software as a Service Agreement. Section 2.4 commits NetDocuments to store Customer Repository Data in the region on the Order Form and not to transfer or access it except at the customer's or a user's direction or as law requires; sharing and access by users outside the region are excepted where the customer sets them up. Regional entry points cover the United States, United Kingdom, Germany, Australia and Canada, and the contracting entity follows the region. Tenancy is described as the customer's private repository on the ND Network. Customer Managed Storage Locations using ndFlexStore or ndMirror let a customer keep repository data on servers NetDocuments does not host. Processing is addressed separately from storage: section 4.2 says help desk staff or subcontractors may work from regions outside the customer's Service Region, and the customer must say in advance if its policies or law restrict that. Where Azure OpenAI inference runs for a customer in a given region is not published.

Exhibit B binds iManage to security practices at least as protective as ISO 27001 and ISO 27017 or equivalent standards, assessed annually by an independent third party, to annual independent penetration testing, and to a business continuity plan compliant with ISO 22301. On request, no more than once a calendar year and subject to the agreement's confidentiality terms, iManage will make available its ISO 27001 certification and SOC 2 or SOC 3 reports. A customer may also commission its own audit once a year, at its own cost, through an accredited firm on twenty days' notice. No auditor, certificate number, audit period or report date is published. A trust center runs at compliance.imanage.com, hosted on Vanta.

Exhibit B of the Software as a Service Agreement commits NetDocuments to an annual SOC 2 Type 2 audit for security, availability and privacy and to maintaining ISO 27001 certification or a comparable successor. It says all data centers fall within the annual ISO 27001 audit and that the listed controls are verified in both. No auditor, audit period or report date is published. The agreement names a trust website, trust.netdocuments.com, a TrustShare portal offering Due Diligence Response material.

AI processing stays on the iManage platform, with content not moved outside it, and the AI is available only on the cloudimanage.com endpoint. The subprocessor list names Microsoft Corporation (Azure). The DPA commits to 60 days' notice before any new subprocessor touches customer data, with an objection right and a termination remedy. The models and their providers are not named: the AI page refers throughout to "our third-party model providers" without naming one. The Azure entry shows where processing happens, not whose model runs. The Microsoft relationship is described in product terms, a Copilot plugin and AI Services feeding Copilot, which is a different fact from the provider of the models behind Ask iManage.

The Legal AI page says ndMAX is powered by Microsoft Cognitive Services and Azure OpenAI and their suite of OpenAI models. Only inputs and outputs are shared with the LLM, they are not kept beyond the exchange, and an agreement with Microsoft keeps customer content from triggering Microsoft's abuse monitoring. The same FAQ reserves the right to change what sits underneath. The solutions are described as model agnostic, so better models may be used as they are developed, after internal testing. No specific model is named and no inference location is stated. The only notice mechanism in the agreement is the general notice of material changes to Common Subcontractors in section 12.2, which is not a commitment about models. MCP connectivity, which lets a firm's own ChatGPT, Claude, Copilot or Harvey reach NetDocuments content, reflects the customer's model choice, not the vendor's supply chain.

Every path on the site ends at Book a Demo, and no price, band or unit figure is published. The AI FAQ states that Mailbox Assistant, AI Services and Ask iManage are not included in a standard cloud subscription and must be bought as additional products. The product catalog splits the platform into named modules a buyer can map to a quote. The agreement adds the mechanics. Fees are set in the Order in a named currency, orders cannot be canceled and payments are not refundable, and each order renews automatically for one year terms unless either party gives 30 days' notice. Late payment accrues 1.5 percent per month, disputed fees must be raised within 30 days, and service credits are a percentage of one twelfth of the annual subscription fee. Section 3.2 confirms the license is per user by prohibiting multiple users from sharing a per user feature. Fees may also be set by a Partner rather than by iManage.

Every purchase path on the site ends at Contact Sales or a demo request, and no price, band or unit figure appears on the site. The agreement supplies the structure. Fees are set in an Order Form as recurring Subscription Fees with a Billing Commencement Date. Under section 4.2, a customer exceeding the user, lawyer, document or other license metrics in the Order Form is invoiced for the overage. Section 4.4 caps annual increases at CPI plus five percent, no more than once a year, section 8.1 requires disputed invoices to be raised within thirty days, and Exhibit A sets service credits as a share of the annual fee. Tier names appear in product material, with ndMAX Enterprise named as the plan that receives Smart Answers and expanded MCP connectivity. The unit, the cap on increases and the plan structure are published before a sales call; the price is not.

The site has separate pages for global, midsize and small law firms and for financial services, accounting, government, media and entertainment and other knowledge workers. Department pages cover corporate legal, compliance, finance, human resources and knowledge management, and the customer evidence spans a US law firm and a global corporate legal department. Practice coverage is described through the work the AI does, not by practice area. It answers questions across the repository, extracts clauses, compares redlines, summarizes, structures results into tables by attributes such as judges and jurisdictions, and applies a corporate legal team's contract playbook, with transaction work covered by Closing Folders. No practice area, jurisdiction or language is named as out of scope. The stated limit is technical: AI capabilities exist only on the cloudimanage.com endpoint, and customers are still being migrated there.

The site has separate pages for small, midsize and large law firms, corporations, in house legal departments, public sector, federal government, and state and local government and higher education. Regional pages cover Asia, Australia and New Zealand, North America, South America, and the UK and Europe. The vendor says it supports more than 7,000 law firms, corporate legal departments and public sector organizations. Practice coverage is described through tasks rather than areas. The ndMAX Studio library covers automatic profiling, NDA analysis, contract risk analysis, playbook creation and application, deposition preparation, judge analytics, offer letter workflows and translation. The benchmark is split evenly between transactional and litigation matters, the closest thing to a statement of where the AI has been tested. No practice area, jurisdiction or language is named as out of scope, and the eDOCS line for on premises customers has no stated boundary with the cloud product.