iManage vs NetDocuments: how they compare in 2026
iManage and NetDocuments both sell cloud document and email management to law firms and corporate legal departments, and each now adds an AI layer that answers questions from the firm's own files with citations. NetDocuments sits in the top two bands on twelve of fifteen axes and iManage on eleven of fifteen, with identical grades on eleven. The separation is accuracy evidence. On 18 August 2026 NetDocuments published its Legal Context Engineering Benchmark: measured answer quality across 300 questions on ten real matters, with the method stated, failures shown, and a class of questions the record cannot answer, where the published example declines rather than guesses. iManage describes how Ask iManage retrieves and cites, and publishes no measurement. NetDocuments also commits by contract to store data in the region on the order form, with five regions published. iManage answers on data stewardship, graded A to NetDocuments' B, because it publishes its subprocessor list and commits to 60 days' notice of any new one, an objection right and a termination remedy, where NetDocuments names no subprocessor beyond Microsoft for its AI.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models are the engine of a core capability layered on a platform that stands entirely without them, and the vendor draws the line itself. The FAQ on the AI page states that Mailbox Assistant, AI Services and Ask iManage are not included in a standard cloud subscription and must be purchased as additional products, and that iManage AI is available only on the cloudimanage.com endpoint, with customers still being moved there. The platform underneath is a document and email management system with security, governance, records, conflicts, knowledge search, transaction management and workflow products, sold for decades and bought for that. AI Enrichment classifies and extracts at scale and Ask iManage answers questions from the repository; remove both and the DMS is unchanged. AI page and Ask iManage page read 7 September 2026.
The models are the engine of a core capability layered on a product that stands entirely without them. NetDocuments is a cloud document and email management system that has been sold for twenty-five years; the ndMAX suite adds a Legal AI Assistant, AI Search, Tabular Review, an App Builder and a library of ready-to-use legal apps, and Smart Answers, which began rolling out to ndMAX Enterprise customers on 31 March 2026, answers questions from the firm's repository with citations. The vendor's own framing is that it brings AI to the content rather than taking the content to AI, and its press material records that more than 800 firms began using the AI capabilities in 2025 and that over forty per cent of new customers select AI at purchase, which describes an option on a platform rather than the platform. Remove the models and the document management, email management, search, security and collaboration product remains and is what most of the 7,000 organisations bought. Legal AI page, Smart Answers press release of 4 March 2026 and the Software as a Service Agreement read 7 September 2026.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Grounding is real and documented with a described retrieval method, short of any published accuracy figure. The vendor sets out Ask iManage as a three-step process: it interprets intent and context from a natural-language prompt rather than keywords, identifies the most relevant material within iManage Work by relevance and context, and generates a natural-language answer anchored with citations so users can verify the sources. The product page states that answers are backed by citations to the firm's own work, that documents never leave the platform, and, in a comparison against general chatbots, that outputs are grounded rather than hallucinated because the system draws only from real documents. Nothing published measures how often that holds: no accuracy figure, no test set, no evaluation of any kind was located. The hallucination claim therefore stands alongside a described architecture rather than alone, so the bottom limb does not fire, and the missing measurement is what separates this from the top band. Two limbs do not apply to a product that cites the firm's own files rather than reported authority and are named rather than penalised. Ask iManage page, AI page and the January 2026 release coverage read 7 September 2026.
Measured accuracy is published with the test set described and the failure modes named, which no other record located in this index does at this depth. The Legal Context Engineering Benchmark, published 18 August 2026 and authored by the VP of Product, reports quality scores for the vendor's own AI answers out of 100 across three model tiers, 64.0, 67.4 and 73.9 without the Legal Context Graph against 65.1, 69.0 and 75.4 with it, alongside correct-answer counts out of 300 and the cost of a correct answer. The test set is described in full: 300 questions across ten real matters, five transactional and five litigation, assembled from public filings and court dockets falling partly outside the models' training cut-off, 874 documents and roughly sixty million characters, nothing synthetic, with six named question types including an Unanswerable class and a per-question rubric, and citations in answers checked deterministically against the corpus with human spot checks. Failure modes are named rather than buried: a worked example shows the product's own answer failing all three criteria without the context layer and still failing one with it, and the report states how a cost-per-correct-answer figure can be gamed by declining hard questions. The method is published for firms to re-run. Two limbs of the band do not bite and are named: the product answers from the firm's own repository rather than from primary legal authority, so there is no citator, and cited sources are documents the reader already holds. The report is the vendor's own internal benchmark rather than third-party validation, and the appendix PDF with per-matter scorecards was not read. Benchmark report web edition read in full 7 September 2026.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Oversight rests on review surfaces rather than on a published control structure. What exists is real: every answer carries citations the user can open to verify the source, all AI interactions stay inside the governed platform with native enforcement of permissions and information barriers, and the vendor describes the result as explainable and auditable in regulated settings. What is not published is any statement of what the system does without a lawyer, any threshold at which it stops, or what happens after an output is wrong, and the May 2026 playbook analysis release describes the feature applying a firm's positions automatically to every contract review without addressing where review sits in that loop. Ask iManage page, AI page and the January and May 2026 release coverage read 7 September 2026.
Autonomy is described and oversight rests on surfaces rather than on a published control structure. The vendor states that the best AI apps run automatically in the background based on a user's actions in NetDocuments, and its MCP connectivity lets external agents orchestrate workflows across systems, which is a real claim of unattended operation. What exists on the oversight side is genuine but is infrastructure rather than a stated model: answers carry citations a lawyer can open, Exhibit B of the agreement commits to document-level activity logging reviewable for ninety days, administrators control which users and applications reach what through the Customer Service Account, and the benchmark report tells readers to read some of the answers themselves before believing any of the numbers. No located material states that the models work alongside a supervising lawyer, names the threshold at which an app acts without one, or says what happens after an output is wrong. The Our Approach to AI video on the Legal AI page was not viewed and is the rebuttal route. Legal AI page, Smart Answers press release and Exhibit B read 7 September 2026.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Real deployment evidence with substance, split between a measured deployment of the platform and unmeasured statements about the AI. The strongest item is the vendor's own release of 12 June 2025: Rio Tinto's legal function replaced a SharePoint-based system with iManage Work 10, Threat Manager and Share, more than 200 users across Australia, Singapore, the United Kingdom and North America, 4.5 million documents migrated, 80 per cent user engagement within four months of go-live with half the department classified as active users, and a named Digital Transformation Lead quoted. That is named, dated and quantified, but it measures the document management deployment, and the same release records Ask iManage as something the customer is exploring rather than running. For the AI itself the evidence is attributed and unmeasured: the Director of Information Technology at Jones Walker LLP on the January 2026 release, a manager at Rio Tinto in trade press, and a Senior Associate at Simpson Grierson describing a trial on the product page. No figure attaches to an AI outcome and no method is published for the 80 per cent. Rio Tinto release, Ask iManage page and January 2026 coverage read 7 September 2026.
Named customers with a figure, short of dates and a method a reader can assess. The Legal AI page carries an attributed customer statement from Jared Gullbergh of Buchanan that a single AI app was calculated to save over 1,500 hours of work a year while producing better work product, alongside attributed statements from Charly Duffy of Coghlan Duffy on the App Builder and Jeff Sabado, Director of Knowledge Management at Davis Wright Tremaine, that the tools already respect the firm's client and matter based security and ethical walls. Corporate figures are published without attribution to any deployment: more than 7,000 law firms, corporate legal departments and public sector organisations, more than 800 firms beginning to use the AI capabilities in 2025, over forty per cent of new customers selecting AI at purchase, and 150-plus integrations. What separates this from the top band is that no deployment is dated and the basis for the 1,500-hour calculation is not published, so a reader cannot assess how it was reached. Legal AI page, Ethical Walls page and Smart Answers press release read 7 September 2026.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Substantive published commitments across most of the ground, short of the privilege limb the top band names separately. Customer Data is the customer's Confidential Information under section 6.1 and must be safeguarded in perpetuity under 6.3(c)(ii), which is a longer commitment than the five years the agreement gives other confidential information; the customer remains sole owner under 5.2; the AI page states that by default neither iManage nor its third-party model providers use customer data to train or retrain models, that data is encrypted and that iManage does not have access to the underlying content; segregation is documented at the level a firm requires, with Security Policy Manager selling information barriers as a product and the January 2026 release stating that AI interactions carry native enforcement of permissions, information barriers and security policies; retention and deletion are set out in the DPA; and Exhibit B records that each customer's data is logically separated from other customers'. Privilege and work product are not addressed on any surface located, which R33 treats as a required limb rather than a formality, and the training promise is prefaced "by default" with an opt-in whose scope is unpublished. Agreement, DPA and AI pages read 7 September 2026.
Substantive published commitments across most of the ground, short of the privilege limb the A band names separately. What is published and binding: Customer Repository Data is confidential under the agreement and NetDocuments disclaims ownership of it (5.2.1); use is confined to providing the Services, facilitating third-party applications the customer selects, help desk support the customer initiates, and legal demands (5.2.2); ethical walls are a documented product with access controls at user, document and workspace level, and the vendor states the AI operates inside a firm's existing permissions and walls; the ndMAX FAQ states inputs and outputs are not kept beyond producing the answer and are not used to train the model; and the position on the model provider is explicit, including an agreement with Microsoft that keeps customer content out of abuse monitoring. Two things hold it here. Privilege and work product are not addressed anywhere located, which R33 makes a required limb of the A band and not a formality. And the training statement is scoped to the LLM rather than to NetDocuments' own use, which is the narrower promise of the two. Agreement, Legal AI page, App Builder page and Ethical Walls page read 7 September 2026.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
No position on the advice line was located, for a product that answers legal questions from a firm's documents, extracts clauses, compares redlines and applies contract playbooks. The Cloud Services Agreement was read in full: it addresses acceptable use, warranties, indemnities and liability and says nothing about advice, competence or supervision, and its warranty disclaimer at 8.5 is a warranty disclaimer rather than a statement of what the product is and is not. The AI and Ask iManage pages carry no disclaimer. The website terms of service are not treated as the product's instrument, following the standing position that a website's terms do not grade the platform. One limb points the right way and is recorded rather than credited: the audience is unambiguous, since the agreement confines use to Authorized Users for the customer's internal business operations and every segment page addresses law firms, corporate legal, compliance and other professional functions, with no consumer surface. This records what is establishable on the date; a product-level acceptable use or AI policy, if one exists behind the trust centre, is the rebuttal route. Surfaces checked 7 September 2026.
No position on the advice line was located on any surface read, for a product whose AI apps analyse NDAs, assess contract risk, produce judge analytics and answer questions about a matter. The Software as a Service Agreement was read in full and addresses use restrictions, AI restrictions binding the customer, warranties and liability without touching advice, competence or supervision; the agreement disclaims that results will meet any requirement (9.4), which is a warranty disclaimer rather than a statement about what the product is and is not. The Legal AI, App Builder and Ethical Walls pages carry no disclaimer. One limb does point the right way and is recorded rather than credited: the audience is unambiguous, since every segment page addresses law firms, corporate legal departments and public sector legal teams, and the agreement confines use to internal business purposes by named Internal and External Users, so there is no consumer-facing surface. This grade records what is establishable on the date rather than a finding that no position exists anywhere; the full text of the Terms of Use, reached only in a search excerpt, is the rebuttal route. Surfaces checked 7 September 2026.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Principles are published without a mechanism a buyer could audit. The AI page states that the platform-based approach enables organisational data to be used securely, responsibly and ethically, whether by iManage or a third party, and the vendor publishes an ESG report and a diversity statement; trade coverage records the appointment of a Vice President of AI Engineering in 2026. Nothing located names who inside iManage is accountable for AI governance, describes what is tested before an AI capability ships, or discloses any finding about uneven output across matter types or populations, and no governance standard such as ISO 42001 was located. The Vanta-hosted trust centre would be the route to more and returns page metadata with no body on this channel, which is recorded as a retrieval limit and named as the rebuttal route rather than counted against the vendor. AI page and trust centre attempted 7 September 2026.
Published substance with an owner and a testing regime, short of a governance framework and any bias disclosure. The Legal Context Engineering Benchmark is a signed technical report by the VP of Product describing what is tested and how, including a testing harness that compares the two tool surfaces before a run and refuses to proceed if they differ in any respect other than the capability under test, deterministic validation that citations map to the corpus, human subject-matter spot checks, and a published method other organisations can apply. The report also discloses its own limits: that it does not yet measure change over a matter's life, that the vendor deliberately withholds its context build cost because it varied roughly sixfold across ten matters and a single figure would mislead, and that the report was drafted with AI assistance. What is absent is the governance half of the axis. No responsible AI framework, policy or standard such as ISO 42001 was located, nobody is named as accountable for AI governance as distinct from authoring the benchmark, and nothing published addresses uneven output across matter types or populations. The unread appendix PDF carries per-matter scorecards and is the route to more. Benchmark report read 7 September 2026.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Retention, deletion, access control, subprocessors and incident practice are all published, current and specific enough to hold the vendor to, and all of it sits in the agreement rather than on a marketing page. The DPA commits to notifying the customer of a Security Incident without undue delay and in any event within 48 hours, with investigation, information in phases, mitigation and assistance with the customer's own notification duties. Deletion is dated: the customer can access, extract and delete Customer Data at any time during the term, iManage retains it for 90 days after expiry so the customer can extract it, then disables the account and deletes within 30 days, certifying where law requires, with backups overwritten in the ordinary course and never held beyond 90 days. Exhibit B carries AES-256 encryption at rest, encrypted transit and backups, least-privilege access with unique usernames that are never recycled, lockout on repeated failures, monthly vulnerability testing, annual independent assessment against ISO 27001 and ISO 27017, annual third-party penetration testing, Tier 3 or better data centres and logical separation of each customer's data. Subprocessors are the limb most vendors miss and the one iManage publishes: a maintained list, 60 days' advance notice before a new subprocessor touches customer data, a 30-day objection right, four named cure routes and a termination remedy with pro-rata refund if the objection is not resolved. Agreement, Exhibit B and DPA read in full 7 September 2026; the subprocessor list itself refuses automated access and was read through the search index.
Substantive published policy covering most of the ground in a binding exhibit, short of a named subprocessor list. Exhibit B of the Software as a Service Agreement commits NetDocuments to report confirmed Unauthorized Access to the customer without unreasonable delay and within 24 hours, with root cause analysis and a mitigation plan; to encrypt Customer Repository Data in transit and at rest; to least-privilege access with removal on termination of employment; to independent penetration tests at least twice per twelve months and monthly internal and external vulnerability scanning; to document-level and administrative activity logs reviewable by the customer for ninety days with NetDocuments retaining log information for at least a year; to storage across two or more geographically separate data centres; and to disaster recovery targets of a two-hour recovery point and six-hour recovery time. Deletion is governed by the agreement at 7.4, with the customer responsible for export and NetDocuments free to destroy remaining data thirty days after the term. The gap is subprocessors: section 12.2 permits Common Subcontractors and promises Digital Notice of material changes and additions without publishing who they are, and the only named processor anywhere is Microsoft for the AI. Agreement, Exhibit B and Legal AI page read 7 September 2026.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
What the vendor stands behind is published and specific, and in one respect it is better than the corpus norm. Section 9.1 gives a defence and indemnity against third-party claims that the Services infringe intellectual property rights, with three named exclusions, and 9.4 sets out the mitigation ladder of procuring the right, modifying or replacing the service, or terminating with a refund of the prepaid balance. Section 10.2 caps each party at the greater of twelve months' fees or fifty thousand US dollars, so a small customer has a floor rather than a cap equal to a small invoice, which is unusual in this corpus. Section 10.1 excludes consequential loss for both parties, and 10.3 lifts both the exclusion and the cap for fraud, for the indemnities, for negligence causing death or personal injury and for wilful misconduct. Section 8.3 warrants performance by qualified personnel to industry standards, that the Cloud Services are free of harmful code, and that they will perform substantially in accordance with the documentation. Exhibit A adds a 99.9 per cent availability commitment with a published service credit schedule and a right to terminate where availability falls below 99.0 per cent in three months of any six. No insurance is stated, and nothing addresses liability for a wrong AI output specifically. Agreement read in full 7 September 2026.
What the vendor stands behind is published and specific. Section 11.1 of the Software as a Service Agreement gives a defence and indemnity against third-party claims that the Services infringe intellectual property rights, with three named exclusions and modify, licence or terminate remedies at 11.3.3; section 10.3 caps each party at the annualised subscription fee paid or payable at the time of the event, with the indemnity obligations carved out of the cap; 10.1 excludes indirect and consequential loss; 10.4 preserves liability for death or personal injury caused by negligence and for fraud; 9.2 warrants that the Services will be performed with the care and skill of a professional and competent provider; and Exhibit A publishes a 99.9 per cent availability target with a graduated service credit schedule that functions as an agreed remedy. No insurance is stated. One asymmetry a buyer should read before signing, recorded here because it is what the agreement says rather than because it moves the grade: section 10.1 removes every liability limitation for the customer's breach of the AI Restrictions in section 3.5, so NetDocuments may recover lost profits, lost business opportunity, lost competitive advantage and all indirect and consequential damages without cap, while the customer's own recovery remains capped at one year of fees. Agreement read in full 7 September 2026.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Real integrations are named and their boundary is described, short of an implementer's account of what moves in which direction. The vendor publishes a Microsoft partnership page and describes a plug-in connecting Microsoft 365 with iManage while keeping the repository as the single source of truth, sells a Model Context Protocol connection as an open standard that lets AI and legal technology tools reach iManage content without custom connectors, and states in the January 2026 release that the same underlying AI services expose content to third-party applications through MCP with permissions and information barriers enforced and content never leaving the platform. Access software (ndOffice equivalents, mobility clients) is defined in the agreement, and the Rio Tinto release describes API integration between iManage and that customer's own digital legal hub with iManage as the core content layer. The agreement is candid that third-party products and any data transfer to them are between the customer and that provider, with no iManage warranty. What is not published on the surfaces read is per-integration depth; the MCP product page and partner directory were not read and are the route to more. Agreement, AI pages, MCP references and Rio Tinto release read 7 September 2026.
Real, documented integrations named across the systems legal work lives in, short of an implementer's description of what moves in which direction. The vendor states the platform integrates with more than 150 technologies including Microsoft 365, Teams and DocuSign, publishes an App Directory and partner locator, and ships ndOffice and mobile access software defined in the agreement. The 2026 additions are the substantive part: Model Context Protocol connectivity lets external AI applications and agents reach NetDocuments content and orchestrate workflows without file downloads or manual transfers, with the vendor naming ChatGPT, Claude, Claude Cowork and its legal plugin, Microsoft Copilot, Perplexity, Google Gemini Enterprise, Harvey and Legora, and stating the boundary that this operates within existing permissions, ethical walls and audit controls with no content leaving the platform. The agreement describes what a firm must do for the API: it is not included in the subscription, access is granted on request after registering an application, it may not be shared, and further terms may be imposed. What is not published on the surfaces read is per-integration depth, which lives in the unread App Directory and support documentation. Smart Answers press release, agreement section 4.4 and Legal AI pages read 7 September 2026.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
The deployment model is stated clearly with partial residency detail, and the processing question is answered with unusual candour. Region is a defined term in the SLA, availability is measured and credited per region, and DPA 12.4 states that all Customer Data is stored in the geographic region set out in the applicable Order. The same clause then discloses what most vendors leave unsaid: iManage may provide the Services from regions other than the one in the Order, naming the United States, the United Kingdom, Canada, Australia and India, so iManage personnel in those locations may have access to Customer Data, and DPA 12.1 warns that this applies even where the customer has agreed to hosting in the EEA or the United Kingdom. Transfers out of the EEA and UK run on the 2021 Standard Contractual Clauses with the UK Addendum, incorporated by reference in Schedule 1. Tenancy is addressed in Exhibit B as logical separation of each customer's data. What is not published on the surfaces read is the list of regions a buyer can actually choose from, which sits behind the Order and on the unread Cloud page; the AI adds a further constraint the vendor states plainly, that iManage AI runs only on the cloudimanage.com endpoint. Agreement, DPA and AI page read 7 September 2026.
Deployment options and residency are published and contractual, and processing is addressed separately from storage. Services Region is a defined term in the Software as a Service Agreement, and section 2.4 commits NetDocuments to store Customer Repository Data in the region specified on the Order Form and not to transfer or access it except at the customer's or a user's direction or as required by law, with sharing and out-of-region user access carved out where the customer configures it. Five regional entry points are published on the site: United States, United Kingdom, Germany, Australia and Canada, and the contracting entity itself follows the region. Tenancy is stated as the customer's private repository on the ND Network, and Customer Managed Storage Locations using ndFlexStore or ndMirror let a customer hold repository data on servers NetDocuments does not host, which is the tier difference described. The processing limb is met expressly and against the vendor's interest: section 4.2 records that help desk support may be provided by personnel or subcontractors in regions other than the customer's Service Region and requires the customer to say so in advance if its policies or law restrict that. One thing a buyer should ask about is not published: where Azure OpenAI inference runs for a customer in a given region. Agreement and site region list read 7 September 2026.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Certification is real and contractually committed, short of evidence a buyer can reach without asking. Exhibit B binds iManage to adhere to information security practices at least as protective as ISO 27001 and ISO 27017 or equivalent standards, to have an independent third party assess those standards annually, to undergo annual independent penetration testing, and to maintain a business continuity plan compliant with ISO 22301. The route to proof is stated and gated: on request, not more than once a calendar year and subject to the agreement's confidentiality terms, iManage will make available its ISO 27001 certification and SOC 2 or SOC 3 reports; a customer may also commission its own audit once a year, at its own cost, through an accredited firm on twenty days' notice. No auditor, certificate number, audit period or report date was located, and the trust centre at compliance.imanage.com is a Vanta-hosted portal that returns page metadata with no body on this channel, so whether anything there is self-serve could not be established. That is recorded as a retrieval limit and the portal is the rebuttal route; the lower tier is graded with the reason stated. Exhibit B read in full and trust centre attempted 7 September 2026.
Certification is real, named and contractually committed, short of evidence this channel could reach. Exhibit B of the Software as a Service Agreement commits NetDocuments to have a Type 2 SOC 2 audit for security, availability and privacy undertaken annually and to maintain ISO 27001 certification or a comparable successor, states that all data centres fall within the scope of the annual ISO 27001 audit, and records that the listed controls are verified in both. That is a named scope and a stated cadence carried in a binding instrument rather than a badge, which is more than most records on this axis have. What is missing is the accessible half: no auditor, no audit period and no report date were located, and the trust website named in the agreement, trust.netdocuments.com, is a TrustShare portal that returns a JavaScript shell with no body on this channel, so whether its Due Diligence Response material is self-serve or sales-gated could not be established. Recorded as a retrieval limit rather than as an absence, with the trust site as the rebuttal route; under the standing convention the lower tier is graded and the reason stated. Agreement Exhibit B read in full and trust site attempted 7 September 2026.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The architecture is described and change notification is contractual; the model providers themselves are never named. What is published: AI processing stays on the iManage platform with content not moved outside it, the AI is available only on the cloudimanage.com endpoint, the subprocessor list names Microsoft Corporation (Azure), and the DPA commits to 60 days' advance notice before any new subprocessor touches customer data with an objection right and a termination remedy, which is a stronger change-notice mechanism than most records in this corpus carry. What is absent is the identity of whose models run: the AI page refers throughout to "our third-party model providers" without naming one, no model is named anywhere, and naming Azure identifies where processing happens rather than whose model it is. The Microsoft relationship is described in product terms, a Copilot plug-in and AI Services feeding Copilot, which is a different fact from the provider of the models behind Ask iManage. The B is earned on the architecture limb rather than the provider limb, and the gap is the one a client's AI clause asks about. AI page, agreement, DPA and subprocessor list (via search index) read 7 September 2026.
The provider is named and the architecture described; the models are not named and change notice is reserved rather than committed. The Legal AI page states that ndMAX is powered by Microsoft Cognitive Services and Azure OpenAI and their suite of OpenAI models, that only inputs and outputs are shared with the LLM, that they are not kept beyond the exchange, and that an agreement with Microsoft prevents customer content from triggering Microsoft's abuse monitoring. The same FAQ reserves the right to change what sits underneath: the solutions are described as model agnostic, so that if better models are developed they may be used, and new models are tested internally and made available as they appear. No specific model is named, no inference location is stated, and the only change-notification machinery located is the general Digital Notice of material changes to Common Subcontractors at section 12.2 of the agreement, which is not a commitment about models. One fact is deliberately not counted here: the MCP connectivity that lets a firm's own ChatGPT, Claude, Copilot or Harvey reach NetDocuments content is the customer's model choice reaching the vendor, which is extensibility and is credited on the integration axis instead. Legal AI page and agreement read 7 September 2026.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The shape of the charge is visible and the number is not. Every path on the site ends at Book a Demo, and no price, band or unit figure appears on any page read. What is published is structure. The AI FAQ states that Mailbox Assistant, AI Services and Ask iManage are not included in a standard cloud subscription and must be purchased as additional products, which tells a buyer that AI is a separate line before any conversation. The product catalogue splits the platform into named modules a buyer can map to a quote. The agreement adds the mechanics: fees are set in the Order in a named currency, orders are non-cancellable and payments non-refundable, each order renews automatically for one-year terms unless either party gives 30 days' notice, late payment accrues 1.5 per cent per month, disputed fees must be raised within 30 days, and the SLA sets service credits as a percentage of one twelfth of the annual subscription fee. Section 3.2 confirms the licence is per-user by prohibiting multiple users sharing a per-user feature. Fees may also be set by a Partner rather than by iManage, which a buyer purchasing through a reseller should read. No VendorPricing row is written, since a row belongs to vendors graded A or B on this axis. Agreement and site read 7 September 2026.
The shape of the charge is published and no number is, at any tier. Every purchase path on the site ends at Contact Sales or a demo request, and no price, band or unit figure appears on any page read. What lifts this off the floor sits in the published agreement rather than on a pricing page: fees are set in an Order Form as recurring Subscription Fees with a Billing Commencement Date, section 4.2 records that a customer exceeding the End User, lawyer, document or other licence metrics stated in the Order Form is invoiced for the overage, section 4.4 caps annual increases at CPI plus five per cent no more than once a year, section 8.1 requires disputed invoices to be raised within thirty days, and Exhibit A sets out service credits as a proportion of the annualised fee. Tier names are visible in the product material, with ndMAX Enterprise identified as the tier receiving Smart Answers and expanded MCP connectivity. So a buyer can learn the unit, the escalation ceiling and the tier structure before a sales call, and cannot learn the price. No VendorPricing row is written: under the pull 7 convention a row belongs to vendors graded A or B on this axis and the grade speaks for the rest. Agreement and site read 7 September 2026.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Segment coverage is described with real substance and the boundaries are left open. The site publishes separate pages for global, midsize and small law firms and for financial services, accounting, government, media and entertainment and other knowledge workers, alongside department pages for corporate legal, compliance, finance, human resources and knowledge management, and the customer evidence spans both a US law firm and a global corporate legal department. Practice coverage is described through the work the AI does rather than by practice area: repository-wide question answering, clause extraction, redline comparison, summarisation, structuring results into tables by attributes such as judges and jurisdictions, and applying a corporate legal team's contract playbook, with transaction work covered by Closing Folders. Nothing published states what is not supported: no practice area, jurisdiction or language is named as out of scope, and the one real limit the vendor does state is technical rather than practice-based, that AI capabilities exist only on the cloudimanage.com endpoint and that customers are still being migrated there. Segment pages, Ask iManage page and release coverage read 7 September 2026.
Segment coverage is described with unusual precision, and the boundaries are left open. The site publishes separate pages for small, midsize and large law firms, corporations, in-house legal departments, public sector, federal government, and state, local government and higher education, plus regional pages for Asia, Australia and New Zealand, North America, South America, and the UK and Europe, and the vendor states it supports more than 7,000 law firms, corporate legal departments and public sector organisations. Practice coverage is described through the work rather than by area: the ndMAX Studio library covers automatic profiling, NDA analysis, contract risk analysis, playbook creation and application, deposition preparation, judge analytics, offer letter workflows and translation, and the benchmark corpus is split evenly between transactional and litigation matters, which is the closest thing to a statement of where the AI has been tested. Nothing published states what is not supported: no practice area, jurisdiction or language is named as out of scope, and the eDOCS line for on-premises customers is presented without a boundary against the cloud product. Site segment pages, ndMAX Studio, Legal AI page and benchmark report read 7 September 2026.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
A product page states no training and the published agreement carries no matching term. The AI page answers the question directly for both iManage and its model providers and extends the promise to AI inputs and outputs, adding that data in the cloud is encrypted and that iManage does not have access to the underlying content. Two qualifiers travel with it and are recorded here rather than smoothed over: the sentence is prefaced "by default", and the same answer discloses that customers may voluntarily opt in to certain services that let iManage collect limited insights for the sole purpose of improving those services, described as optional and disclosed at the time of use, with no published statement of what an insight is or whether it can reach document content.
The Cloud Services Agreement and its Data Protection Agreement were read in full and never name training: processing is confined to Documented Instructions and to incidental business operations listed as delivering functionality, fixing problems and providing support, with a separate undertaking not to derive information from customer data for advertising or similar commercial purposes and never to sell personal data.
A clause that does not name the thing is not evidence about training in either direction, so the policy statement carries the value. Agreement, DPA and AI page read 7 September 2026.
A product page states no training and the published agreement carries no matching term. The ndMAX FAQ on the Legal AI page states that only inputs and outputs are shared with the LLM, that they are not kept beyond the exchange, and that they are not used to train it, and the App Builder page adds that an agreement with Microsoft ensures customer data is not used to train the Azure OpenAI model and is not subject to human or machine sensitive content monitoring.
Two scope points a buyer should carry. The statement is about the LLM, which is Microsoft's model, and no located material says whether NetDocuments itself uses customer content to improve its own systems. And the Software as a Service Agreement, read in full, confines use of Customer Repository Data to providing the Services and never names training, while separately defining Platform Data as data and statistics generated in connection with use of the Services, which NetDocuments may use to analyze performance and usage in order to provide or improve the Services and may use in anonymized aggregated form for benchmarking.
That clause names no model and operates on usage data rather than on repository content, so it is recorded here rather than treated as a training permission. Agreement, Legal AI page and App Builder page read 7 September 2026.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Retention is acknowledged and no period is published for what a lawyer types. The vendor states that data processed by iManage AI stays on the platform under the same governance as everything else, which answers where it goes and not for how long. The document regime around it is precise and is recorded so a reader can see the gap rather than assume it is filled: under the Data Protection Agreement the customer can access, extract and delete Customer Data at any time during the term, iManage keeps it for 90 days after the subscription ends so the customer can extract it, then disables the account and deletes within 30 days, with backups never retained beyond 90 days, and the platform sells Records Manager and Disposition Manager for the customer's own retention policies.
None of that is stated to apply to Ask iManage prompts and generated answers specifically, and no zero-retention option is offered anywhere located. Reading the repository regime across to the prompt question would be an inference the record should not make. AI page, agreement and DPA read 7 September 2026.
A specific retention position is published and the customer does not set it. The ndMAX FAQ states that inputs and outputs are not kept beyond the exchange of information needed to produce the output, which is a stated period of none rather than a window a customer configures, and no zero-retention setting or alternative window is offered anywhere located. Two adjacent facts that are not the same thing and are recorded so they are not read as one: an output a user saves into the repository becomes Customer Repository Data and is then governed by the customer's own retention and by the agreement's deletion terms, and Exhibit B commits to document-level activity logs the customer can review for ninety days with NetDocuments retaining log information for at least a year, which is audit metadata rather than prompt content. Legal AI page and agreement Exhibit B read 7 September 2026.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Retrieval enforces the firm's own access model at query time and the vendor documents it, in the case where the vendor is itself the source system. The January 2026 Ask iManage release states that all AI interactions stay inside the governed platform with native enforcement of permissions, information barriers and security policies, that content is not moved outside the environment, and that the same applies to third-party tools reaching content through the Model Context Protocol.
Security Policy Manager is sold as a product for building those barriers with multi-level security, and the product page describes the assistant as permission-aware and respecting access and metadata. What is not published is the enforcement point: whether a barrier is applied before the index is searched or filters results afterwards, which decides whether an agent can infer that walled content exists. Release text of January 2026, Ask iManage page and Security Policy Manager page read 7 September 2026.
Retrieval enforces the firm's access model at query time and the vendor documents it, in the unusual case where the vendor is itself the source system. Ethical walls are a documented product with access controls at user, document and workspace level and reporting on who accessed which document, and three vendor statements place the AI inside them: the Smart Answers release of 4 March 2026 states that answers are produced within the existing security, governance and ethical wall controls and that MCP connectivity operates within existing permissions, ethical walls and audit controls with no content leaving the platform, and the Legal AI page carries a named customer, the Director of Knowledge Management at Davis Wright Tremaine, saying the tools already respect the firm's client and matter based security and walls.
What is not published is the enforcement mechanism at the retrieval layer itself, whether a wall is applied before or after the index is searched, and that distinction matters to a firm assessing whether an agent can infer the existence of walled content. Ethical Walls page and Smart Answers press release read 7 September 2026.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
The agreement commits to notice where lawfully permitted, and goes considerably further than the value requires. Section 6.4 obliges the receiving party, before disclosing compelled confidential information, to notify the disclosing party in writing so it can oppose the disclosure or seek a protective order, and to give reasonable assistance in doing so, with any disclosure limited to the portion legally required. Section 6.5 adds a law-enforcement protocol specific to iManage: it will not disclose to law enforcement unless required by law, will attempt to redirect the agency to request the data from the customer directly, and if compelled will notify the customer and provide a copy of the demand, assess the legitimacy of the request including the sender's identity, seek clarification of scope and oppose blanket requests, while refusing to give any agency unfettered access, the platform encryption keys or the ability to break the encryption, or access where iManage knows the data is to be used for purposes other than those stated.
No transparency report or request statistics were located, which is the only thing separating this from the top value. Agreement read in full 7 September 2026.
The agreement commits to prior notice where lawfully permitted, and no transparency report was located. Section 6.2 of the Software as a Service Agreement permits disclosure of the other party's confidential information to comply with applicable law or a court order, states expressly that in NetDocuments' case such disclosure may include Customer Repository Data, and conditions it on giving prior notice of the compelled disclosure to the extent legally permissible together with reasonable assistance, at the disclosing party's expense, if that party seeks to contest the disclosure.
Prior notice plus an assistance obligation is more than the bare notice most agreements in this corpus carry. No transparency report, request statistics or law enforcement guidelines page was located on any surface read. Agreement read in full 7 September 2026.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
The source behind the answers is identified and no license basis is stated because none is the vendor's to give. Ask iManage answers from the firm's own repository and cites back to it, and the vendor's comparison against general chatbots turns on exactly that, that it uses the firm's actual documents and never leaves iManage Work. No external corpus of law, filings or public material was located anywhere in the product, and no third-party content source is named.
The rights basis for the material the AI reads sits in the agreement rather than in a license: section 8.4 has the customer warrant that it has the necessary rights and consents in the Customer Data, and section 5.2 leaves ownership with the customer. The signal's law-corpus limbs do not bite for a product whose corpus is the buyer's own filing system, and that is recorded rather than graded around. Ask iManage page and agreement read 7 September 2026.
The sources behind the answers are identified and no license basis is stated for anything beyond the customer's own content. The product ships no corpus of law: Smart Answers is grounded in the firm's own document repository and matter history with citations, and the Legal Context Graph organizes that same content. The rights basis for the customer's own material is allocated by the agreement rather than licensed by the vendor, since section 9.3 has the customer warrant it has the legal right to possess, store and transmit its repository data and section 5.2.1 has NetDocuments disclaim ownership of it.
Two things are not established. The August 2026 extension of Legal Authorities to the Legal Context Graph implies a source of law outside the firm's repository, and no license, provenance or update cadence for it was located. And the benchmark corpus, whose provenance is stated as public regulatory filings and court dockets, is a test set rather than a product corpus and is not credited as one. Smart Answers press release, benchmark report and agreement read 7 September 2026.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history. The assistant answers from the firm's own documents and emails and cites to them; nothing read describes a citator, a treatment signal or a prompt to verify legal authority, and the product does not claim to retrieve reported cases. A firm using Ask iManage to find a precedent in its own files would still be relying on a separate research tool for good-law status.
The signal's limbs bite only partly for a document management assistant, and that is stated rather than treated as a failure. Ask iManage page, AI page and January 2026 release coverage checked 7 September 2026.
No located public material addresses whether authority is checked for subsequent history. The product answers from the firm's own documents and matter history and cites back to them, and nothing read describes a treatment signal, a citator license or a verification prompt for legal citations. The August 2026 extension of Legal Authorities to the Legal Context Graph is the one surface that might bear on this and its product page was not read.
The signal's limbs bite only partly for a document management platform whose citations point at the firm's own files rather than at reported authority, and that is recorded rather than graded around. Legal AI page, Smart Answers press release and benchmark report checked 7 September 2026.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
No located public material describes what the product does when it cannot ground an answer. The published three-step method covers interpreting the question, retrieving the most relevant material and generating a cited answer, and stops there; the product page asserts grounded outputs rather than hallucinations because the system draws only from real documents, which is a claim about the corpus rather than a described abstention path.
No confidence score, no no-answer state and no evaluation showing either was located. Ask iManage page, AI page and release coverage checked 7 September 2026.
An explicit no-answer path is documented and observable in published evaluation. The Legal Context Engineering Benchmark of 18 August 2026 defines Unanswerable as one of six question types in its 300-question set, described as questions the record is silent on, so abstention is something the vendor deliberately tests for rather than an incidental behavior. The report then publishes a transcript in which the agent declines to supply a date it cannot support from the documents, and grades that answer against the rubric in the open.
The limit worth stating is that the published example shows abstention in the run without the context layer, and the report does not publish a per-type breakdown of how often the system abstains correctly against how often it should have; the unread appendix carries per-matter scorecards. Benchmark report read 7 September 2026.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
No court order, opinion or disciplinary record naming iManage or Ask iManage was located as of 7 September 2026. The AI Hallucination Cases database maintained by Damien Charlotin was searched on both names together with a general search of the sanctions coverage; the decisions that name legal-specific products name other vendors. This is a statement about the public record, not a finding about the product. Exposure is structurally low for an assistant that answers from a firm's own repository and cites to documents the firm already holds rather than generating legal authority.
No court order, opinion or disciplinary record naming NetDocuments, ndMAX or Smart Answers was located as of 7 September 2026. The AI Hallucination Cases database maintained by Damien Charlotin was searched on the company and product names alongside a general search for sanctions coverage; the records that name legal-specific products name other vendors. This is a statement about the public record, not a finding about the product.
The exposure here is structurally lower than for a research tool, since the assistant answers from the firm's own documents and cites back to them rather than producing legal authority.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Professional obligations are engaged in general terms and no AI guidance is named. The vendor frames the AI around explainable and auditable outcomes in regulated settings, information barriers and conflicts management, and states that its platform approach lets organisational data be used securely, responsibly and ethically; its essay series addresses how law firms should approach AI adoption. None of it names an ABA formal opinion, a state bar opinion, a regulator's AI guidance or a court's standing order.
The professional-responsibility material that does exist is about confidentiality and conflicts, which is credited where it belongs on the walls signal and on confidentiality rather than counted twice here. AI page, Ask iManage page, essay listings and January 2026 release coverage checked 7 September 2026.
Professional obligations are engaged in general terms and no AI ethics guidance is named. The Ethical Walls page frames its controls around preventing conflicts of interest, maintaining client confidentiality and ethical standards, and demonstrating compliance to clients and regulatory bodies, which is real engagement with a lawyer's duties and is already credited where it belongs, on the walls signal and on confidentiality.
What this signal asks is different: whether the vendor engages publicly with the ethics opinions and regulator guidance governing lawyers' use of AI. No located material names an ABA formal opinion, a state bar opinion, a court standing order or any regulator's AI guidance, and the AI adoption resources are framed around investment and results rather than professional responsibility. Ethical Walls page, Legal AI page and resource listings checked 7 September 2026.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The product sits inside law firms' fee relationships with their clients and the published position on the bill is a savings claim. The AI is sold on accelerated productivity, reduced manual effort and time reclaimed for higher-value work, and the January 2026 release describes attorneys reaching an answer instead of wading through search results; the platform is sold to law firms that bill clients for the work it speeds up.
Nothing located addresses how AI-assisted work is recorded against a matter, whether compressed time is disclosed to the client, or what a firm should say when research that took hours now takes minutes. The vendor sells time-recording adjacent products and a conflicts and intake product, and neither is presented as answering the fee question. Ask iManage page, AI page and release coverage checked 7 September 2026.
The product sits inside law firms' fee relationships with their clients and the published position on the bill is a savings claim. A named customer at Buchanan states that one AI app was calculated to save over 1,500 hours of work a year, and the Legal Context Engineering Benchmark quantifies a different saving, forty-eight percent off the cost of a correct AI answer and roughly $940,000 a year for a 2,000-person firm, which is the firm's own AI spend rather than anything reaching a client's invoice.
Nothing located addresses how AI-assisted work is recorded on a matter for billing purposes, whether time compressed by the assistant is disclosed to the client, or what a firm should tell a client whose work took an hour instead of six. The platform holds the documents rather than issuing the invoice, but it is bought by firms that bill clients for the work it accelerates, so the question applies. Legal AI page and benchmark report checked 7 September 2026.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A current subprocessor list is published with contractual change notice, and the model provider is not named. What a firm can forward today: a maintained subprocessor page naming Microsoft Corporation (Azure) with an email subscription for change notices; a Data Protection Agreement published in full as Exhibit C to the public Cloud Services Agreement, with the 2021 Standard Contractual Clauses and the UK Addendum incorporated in its schedule, which is drafted to be passed to a client; and a security exhibit setting out the controls.
The DPA commits to 60 days' advance notice before a new subprocessor touches customer data, a 30-day objection right and a termination remedy if the objection is not cured, which is stronger than most agreements in this corpus offer. The limb that fails is the one a client's AI clause turns on: the AI page refers to "our third-party model providers" and never names them, and naming Azure states where processing runs rather than whose model reads the documents, so a firm can prove its contracting position and cannot answer the model question. Agreement, DPA and subprocessor list (via search index) read 7 September 2026.
The model provider behind the AI is named publicly and no subprocessor list is published. A firm answering a client's AI clause can point to the ndMAX FAQ, which names Microsoft Cognitive Services and Azure OpenAI as what sits behind the generative features, states that inputs and outputs are not kept beyond the exchange and are not used to train the model, and records an agreement with Microsoft exempting customer content from abuse monitoring; the full Software as a Service Agreement and its security exhibit are published and forwardable, which covers the incident notice and control commitments a client is likely to ask about.
Two limbs are short. Section 12.2 of the agreement reserves the use of Common Subcontractors with notice of material changes but publishes no list of who they are, so there is no current subprocessor register to forward. And the Data Processing Addendum, which is the artifact drafted to be passed on, is provided on request under section 6.3 rather than published. Agreement and Legal AI page read 7 September 2026.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Elements of a record exist without an export built for disclosure. Each answer is anchored with citations so a user can verify the sources it rests on, the vendor describes AI outcomes as explainable and auditable in regulated settings, and the platform sells Threat Manager for monitoring user activity and audit reporting across the repository. Between them a firm can show which documents an answer drew on and who accessed what.
What is not published is a per-document export covering the model used, the retrieval performed and the human verification applied, and no disclosure template or guidance for a court's standing order on AI use was located. January 2026 release coverage, Ask iManage page and product catalog checked 7 September 2026.
Elements of a record exist without a document-level export built for disclosure. Exhibit B of the agreement commits to logging that lets a customer review document-level events and administrative changes for the previous ninety days, with NetDocuments retaining log information for at least a year, and the Ethical Walls page describes reporting on exactly who accessed which documents; on the output side, Smart Answers returns answers with citations to the source documents.
Between them a firm can establish which documents an assistant touched and what an answer was grounded in. What is not published is any per-document export covering the model used, the retrieval performed and the human verification applied, and no disclosure template or guidance for a judge's standing order on AI use was located. Agreement Exhibit B, Ethical Walls page and Smart Answers press release read 7 September 2026.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- UPL and Professional Responsibility Posture
- Good Law Verification
Which one fits
Choose iManage if
- Your clients audit your vendors' vendors. iManage publishes a maintained subprocessor list naming Microsoft Azure, commits to 60 days' notice before a new subprocessor touches customer data, gives a 30 day objection right, and lets you terminate with a pro rata refund if the objection is not resolved.
- You need to know what happens when a government asks the vendor for your files. iManage's agreement commits it to try to redirect an agency to you, to notify you with a copy of any compelled demand, to oppose blanket requests, and never to hand over its platform encryption keys or unfettered access.
- You are a smaller firm, and a cap equal to one year of fees would be a small number. iManage caps each party at the greater of twelve months' fees or $50,000, lifts the cap for its intellectual property indemnity, and lets you terminate if availability falls below 99.0 percent in three months of any six.
Choose NetDocuments if
- You want to see accuracy measured before you rely on AI answers. NetDocuments' benchmark of 18 August 2026 reports answer quality scores out of 100 across three model tiers, from 64.0 to 75.4, on 300 questions drawn from public filings and court dockets, and publishes the method so a firm can rerun it.
- Your data must stay in a named country. NetDocuments' agreement commits to store repository data in the region on your order form and not to move it except at your direction or as law requires, with the United States, United Kingdom, Germany, Australia and Canada published, and ndFlexStore or ndMirror can hold data on servers NetDocuments does not host.
- You want to know whose model reads your documents and how long it keeps them. NetDocuments names Microsoft Cognitive Services and Azure OpenAI, states that inputs and outputs are not kept beyond producing the answer and do not train the model, and has an agreement with Microsoft that keeps customer content out of abuse monitoring.
In summary
iManage
iManage is a cloud document and email management platform for law firms, corporate legal departments, financial services, accounting and government, built around iManage Work with products for information barriers, records, conflicts and knowledge search. Its AI layer, sold separately, includes AI Enrichment and Ask iManage, which answers questions from the firm's own repository with citations the user can open. The AI Legal Index grades it in the top two bands on eleven of fifteen capability axes, with A grades on data stewardship and on liability: its published agreement caps liability at the greater of twelve months' fees or $50,000 and commits to 60 days' notice before any new subprocessor. As of 7 September 2026 the index located no accuracy measurement, no named model provider and no position on the line between legal tooling and legal advice.
NetDocuments
NetDocuments is a cloud document and email management platform for law firms, corporate legal departments and public sector legal teams, based in Lehi, Utah, and used inside Word, Outlook and Teams. Its AI suite, ndMAX, includes a Legal AI Assistant, Tabular Review, an App Builder and Smart Answers, which answers from the firm's repository with citations. The AI Legal Index grades it in the top two bands on twelve of fifteen capability axes, with A grades on citation accuracy, liability and deployment. On 18 August 2026 it published a benchmark measuring answer quality across 300 questions on ten real matters, together with its method. Its AI runs on Microsoft Azure OpenAI. As of 7 September 2026 the index located no published subprocessor list, no price and no position on the line between legal tooling and legal advice.
Questions buyers ask
iManage vs NetDocuments: which is better for a law firm?
On published evidence they are one axis apart: NetDocuments sits in the top two bands on twelve of fifteen AI Legal Index capability axes and iManage on eleven of fifteen, with identical grades on eleven. NetDocuments publishes measured AI accuracy and contractual data residency. iManage publishes a subprocessor list with a strong change notice right and a detailed law enforcement protocol. Both enforce the firm's own permissions and ethical walls inside their AI, and both sell the AI as an addition to the platform.
Does iManage train AI on client documents?
iManage states that by default neither it nor its third party model providers use customer data in the iManage Cloud, including AI inputs and outputs, to train or retrain models, and that it has no access to the underlying encrypted content. Customers may opt in to services that let iManage collect limited insights to improve those services, and what an insight covers is not published. The Cloud Services Agreement never names training, so the commitment is a published policy rather than a contract term. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 25, 2026. No vendor pays for placement.
Do iManage and NetDocuments enforce ethical walls in their AI?
Both state that they do. iManage says all AI interactions stay inside the governed platform with native enforcement of permissions, information barriers and security policies, including for outside tools connecting through the Model Context Protocol. NetDocuments says Smart Answers and its MCP connections operate within existing permissions, ethical walls and audit controls, with no content leaving the platform. Neither publishes whether a wall is applied before the index is searched or to results afterwards, which decides whether an AI could reveal that walled content exists. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 25, 2026. No vendor pays for placement.
Which AI model does NetDocuments use?
NetDocuments names Microsoft Cognitive Services and Azure OpenAI and their suite of OpenAI models as the engine behind ndMAX, and states that only inputs and outputs are shared with the model, that they are not kept beyond producing the answer, and that they are not used to train it. An agreement with Microsoft keeps customer content out of abuse monitoring. It names no specific model and reserves the right to change models as better ones appear. iManage refers to third party model providers without naming them. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 25, 2026. No vendor pays for placement.
What do iManage and NetDocuments both leave unpublished?
A price, and a position on the lawyer's side of the AI. Neither publishes a figure for the platform or for its AI add on. Neither states that its AI output is not legal advice or addresses competence and supervision duties, and neither names an ethics opinion on AI. Neither addresses how time saved by the AI should appear on a client's bill. Neither says where AI inference runs for a customer in a given region, and neither addresses privilege or work product in the content it holds. Graded by AI Legal Index against 15 capability axes and 12 legal signals, including privilege handling and citation accuracy, from each vendor's own published materials, verified September 25, 2026. No vendor pays for placement.
Three readings to weigh. NetDocuments' benchmark is its own internal test rather than third party validation, and its published example of the system declining to answer comes from the run without its context layer. NetDocuments' agreement removes every liability limit for a customer that breaches its AI restrictions, while the customer's own recovery stays capped at one year of fees; the vendor publishes that term, and a buyer should read it. Both training commitments are published policies rather than contract terms: iManage's is prefaced by default, with an optional insights program whose scope is unpublished, and NetDocuments' covers the Microsoft model rather than its own use. Both records were verified on 7 September 2026. Neither vendor reviewed this page.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything above comes from public material on the dates shown. How the index grades.