Leah vs Legora: how they compare in 2026
These two answer to different buyers and belong to different product classes. What separates them is not quality but what each company has chosen to publish. Leah publishes the control and recourse position. The customer sets which agents may act on which data within which thresholds, and every action is logged with its governing policy. A tiered liability cap reaches three times twelve months of fees where the security clause or the data processing addendum is breached. Legora publishes the assurance position: three current independent certifications including ISO 42001 for its AI management system, a public trust center, and its general terms, data processing agreement and security measures annex out in the open with no gate at all. That is the package a firm's risk committee asks for. The split runs the other way on what sits underneath the product. Leah names four model providers with the jurisdictions for each and commits to thirty days notice before a new subprocessor touches customer data. Legora names its model providers in a regional subprocessor list without tying them to functions. Leah sells on a custom quote, and Legora through a demo request.
Which one fits
Choose Leah if
- You are an in house function buying contracting end to end rather than a firm buying a research and drafting workspace. Leah covers guided intake, playbook driven review and redlining in Word, and conditional approval routing with automatic escalation. Execution runs through built in DocuSign and Adobe Sign, and a repository handles obligation tracking and renewal alerts. It integrates outward into SAP, NetSuite, Coupa and Okta rather than into a document management system.
- You need the allocation of loss written out with figures before you sign. Leah's master terms set a general cap at the fees paid in the twelve months before the first incident, and an enhanced cap at three times that figure for breach of the security clause or the data processing addendum. They enumerate uncapped claims covering indemnification, intellectual property and confidentiality. They also carry a customer indemnity, a warranty with a thirty day correction period and published uptime tiers with termination and refund. Legora's terms carry caps and a carve out it calls an Enhanced Claim, and give no warranty on output.
- A counterparty or a regulator asks which providers see the document. Leah's data processing addendum names Anthropic, OpenAI, Cohere and Google AI/ML against Leah functionality, with the jurisdictions involved for each. It requires a new subprocessor to be added to that published list at least thirty days before it processes customer personal data, with a thirty day objection right. Legora names its model providers in a regional subprocessor list without tying them to functions.
Choose Legora if
- Your risk committee wants certificates and contract documents it can read today. Legora holds ISO 27001:2022 audited yearly, SOC 2 Type II and ISO 42001 for its AI management system. Its public trust center carries a data flow diagram and security whitepapers, and its general terms, data processing agreement and security measures annex are published with no gate at all. Leah claims a longer list of frameworks but contradicts itself on its own site about which are held. It names its auditor as an independent managed security service provider.
- The work is legal work and the users are lawyers. Legora is built as a shared surface where the matter team and the AI sit in the same place, with Tabular Review linking every cell back to its source. It has an iManage technology partnership working through iManage APIs, plus SharePoint, Box, Outlook, EDGAR and a client facing Portal. Leah is sold to in house legal, procurement and finance functions rather than to firms.
- You want the AI governance claim validated by somebody outside the vendor. Legora's ISO 42001 certification covers how AI is designed, deployed, supervised and monitored, independently audited with ongoing surveillance. Leah publishes the more detailed governance narrative of the two, including per action logging of rationale and governing policy. It states that every action is measured against benchmarks for accuracy, bias and outcome.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Leah sells AI agents and an orchestration layer that sit on top of a contract lifecycle platform, and that platform works without them. The vendor describes it the other way round. It says other vendors bolted AI onto systems built for manual workflows, while Leah was designed from scratch with orchestration as the foundation. ContractPod Technologies has sold contract lifecycle management since 2012. Leah launched in March 2023 as an AI services hub within that platform, went standalone in May 2023, and Leah Intelligence followed in October 2024. Without the agents, the product is still a working CLM with guided intake, approval routing, DocuSign and Adobe Sign execution and a contract repository. That CLM has its own market and its own Gartner category placement. The orchestration layer on top is model driven.
Everything Legora sells is generative. The Agent plans and executes legal work across the platform's tools, Tabular Review extracts answers from each document into a grid, research answers questions across jurisdictions, and drafting runs in Word, Outlook and the built in editor. An orchestration layer handles tool routing, memory, model selection and guardrails beneath them. Without the models there is no product left to sell.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
The Contract Helpdesk answers questions from the customer's agreements and links each response to the clause or document supplying the answer. Its illustrated payment example identifies the agreement version and clause number, while Leah Discovery extends retrieval across a portfolio. Users can open the underlying contract and initiate a reminder, amendment or escalation from the answer. This is a described route from a question to its contractual source. However, the product's categorical claim that Leah does not hallucinate is not supported by a published test set or error breakdown. The AI terms expressly disclaim accuracy, completeness and currency, and linked contract text does not validate external legal authority.
Each cell in Tabular Review expands to its reasoning and the source documents behind it, and Portal answers carry links back to the exact source. Legal research works several sources in parallel, ranks them by authority and checks each finding against primary law before the answer returns. The rebuilt research layer announced on 14 September 2026 runs on an ontology of the law that maps how authorities rank and relate, including amendments and temporal validity. Its AI native citator follows a standard set and audited by former publisher attorney editors. Legora says it has cataloged more than 50 ways AI fails at legal research without publishing the list. The layer is in limited beta, and no accuracy figure, evaluation framework or hallucination rate is published.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Customer policies determine which Leah agents may act, the data they may access, thresholds, and escalation requirements. The orchestrator applies approvals, escalations, and rejections during execution, then records the action, rationale, policy, inputs, and outcome. Policies are configurable rather than fixed defaults. The AI terms add a categorical limit: automated decisions with legal or similarly significant effects on individuals require adequate human review and legal compliance. Customers must also check outputs themselves and cannot present them as provider approved or wholly human generated. Trials and betas are restricted to internal evaluation. These contractual limits accompany the product's policy, execution, and audit loop.
The Agent proposes a plan before it acts, carries out the work across documents, data sources and tools, checks whether it met the goal, and delivers work product into the project workspace for the lawyer's review and approval. It can also act without being asked, watching email, documents and projects and starting work when something needs attention. Tabular Review adds Mark as Reviewed, Lock Cells and Review Mode for team review, and full audit trails record every tool call, file access and agent action. ISO 42001 covers the AI management system, with human oversight named as a principle. No threshold at which the Agent stops for a person, and no route after a wrong output, is described.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Leah publishes qualitative quotes from four named people. Noelle Perkins is EVP and Chief Legal Officer at Cushman and Wakefield, and Lidia Kamleh is Chief Legal Officer at Dubai Future Foundation. Frances Bain-Cumberbatch is Chief Legal and External Affairs Officer at Ansa McAL, and Zillia Knight is Senior Legal Officer at Terumo Europe. Three results are published with the customer unnamed. A major American logistics company cut contract review time by 91 percent. A global manufacturer protected more than $18 million of revenue, and an American retail REIT tracked more than $2 million of savings. About 54 enterprise logos appear, including Philips, MUFG, Sandoz, Pernod Ricard, Alaska Airlines and Wood PLC. PwC and KPMG appear among them. PwC entered a commercial alliance in March 2024, and Epiq resells Leah in its Service Cloud. Integreon is quoted as an early adopter that resells it, and Pinsent Masons adopted it for managed legal services in July 2025. Partners and customers are shown together without distinction, and the Chief Product Officer of Execo, another services partner, is among the testimonials.
Legora counts more than 1,800 teams in over 50 markets and 100,000 lawyers on the platform. Named customers include White & Case, Crowell, Accor, Dentons Europe, Trowers & Hamlins and Grant Thornton UK, whose forensic investigations team has a published story. The customers page reports that users see a 25 percent improvement in work quality, that experienced users save 80 percent of non billable hours weekly, and that firms bill $6.4 million more per 100 lawyers a year. None of those figures carries a date, sample or method. An in house study with the analyst Ari Kaplan drew on conversations with 30 customers in nine countries.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Customer inputs and outputs are confidential Customer Data under the May 2026 agreement. Their use is limited to providing and maintaining the service, with a separate AI clause permitting training or improvement solely for that customer's benefit. The trust portal rules out generalized model training, while the DPA identifies four model providers that store or retain no Customer Data. Role permissions and a private Azure OpenAI environment support access isolation. Mutual confidentiality obligations and prior notice of legally compelled disclosure apply. The terms do not expressly preserve privilege or work product, and Leah describes no matter-specific retrieval walls inside a customer's organization.
The general terms bar Legora from using a subscriber's confidential information to train or fine tune AI models and require the same of its subcontractors. The terms, the data processing agreement and the security measures annex are published in versions for the EU and the United States, and the annex covers least privilege access, personnel confidentiality, authorization controls and retention on customer instruction. Ethical walls and role based access are stated to keep confidential information from crossing matters or projects, on access control built on the Zanzibar authorization model, and engineers reach customer data only with the customer's written approval. Privilege and work product handling are not addressed.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Attachment D requires independent review of every AI output for its intended use and prohibits representing output as provider approved or wholly human generated. Automated decisions with legal or similarly significant effects require adequate human review and compliance with law. The platform nevertheless promotes autonomous work across legal, procurement, finance, and contracting functions. These general AI use restrictions establish customer responsibilities, but do not explicitly distinguish legal advice from software assistance, restrict use by jurisdiction, or map professional competence duties. The broad legal automation positioning therefore has a contractual review requirement without a dedicated professional responsibility explanation for practicing lawyers.
Lawyers, firms and in house teams are the buyers, and the product is described as working with lawyers rather than replacing them, with the Agent's output delivered for a lawyer's review and approval. No position on the advice line, no treatment of competence and supervision duties and no jurisdiction limit appears in the acceptable use policy, the general terms or the product pages.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
A dedicated AI governance page names six failure modes the vendor says it engineered out. They include black box decisions that cannot be defended to a regulator or board, and compliance frameworks retrofitted after the fact. Against them the page sets three pillars and a loop of policy, execution and audit. Each action is logged with its rationale and governing policy, in records described as tamper resistant and immutable. The page also says every action is measured against benchmarks for accuracy, bias and outcome, and that accountability is structural rather than aspirational. It names no person or role accountable for model behavior and describes no testing before release. It gives no benchmark method or schedule and discloses no bias measurement result.
Legora holds ISO 42001 for its AI management system, independently audited with ongoing surveillance, and publishes what the certification covers: how AI is designed, deployed, supervised and monitored, with human oversight and structured governance as the operating principles. No internal owner of AI governance is named, no results of testing on model behavior before release are published, and nothing covers uneven output across matter types, parties or populations.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The DPA names model, hosting, support, signature, and integration subprocessors with their locations and purposes. New subprocessors require 30 days' notice and permit an objection, with termination and unused-fee refunds if unresolved. Security incidents affecting personal data require notice within 48 hours of awareness. The trust portal describes role restrictions, identity-provider authentication, monitoring, incident exercises, and penetration testing. Contract data can be exported during the term and deleted following a request after termination, subject to backup and legal exceptions. Leah gives no routine duration for prompt history. Provider-level zero retention does not define the lifetime of records held by Leah itself.
The security measures annex sets least privilege and role based access, and centrally stored logs traceable to unique usernames, with security logs kept at least 12 months. It adds data integrity signing, background checks and confidentiality agreements for staff, and retention as the customer instructs. Subscriber environments are logically separated and full production backups run every four hours. The data processing agreement has Legora report a personal data breach within 36 hours and delete or return personal data at the subscriber's choice when it ends. The subprocessor list, last updated 6 July 2026, names each provider with its purpose, data and residency, and a new subprocessor comes with 30 days to object. Penetration tests cover the full platform twice a year.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Infringement by AI output is excluded from the provider's intellectual property indemnity under the May 2026 Cloud Terms. Attachment D also disclaims output accuracy, completeness and currency, and puts the job of checking results on customers. Ordinary cloud service remedies remain: a performance warranty, correction or termination with a refund after an unsuccessful 30 day fix period, and an indemnity for covered service infringement claims. The general liability ceiling is fees paid or payable in the preceding twelve months, with a threefold ceiling for security or DPA breaches and specified uncapped claims. Trials and betas have no indemnity or warranty and a $1,000 cap. These software remedies do not remove the explicit AI output exclusions.
General terms and conditions are published openly in an EU version and a version for the United States. They carry numbered liability clauses, aggregate caps that apply across the subscriber and its affiliates, a separate cap of €100,000 on beta features, and a carve out the terms call an Enhanced Claim. No indemnity for third party claims arising from output, warranty on output or insurance position is stated.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Contract workflows connect with Salesforce, Microsoft Dynamics and HubSpot opportunities, while an Outlook add in starts contracts, uploads attachments and triggers approvals that synchronize with the CLM. Signature connections let customers configure signing order, copied recipients and expiry dates, then return executed agreements to the repository. Word supports review and tracked changes. The current CLM page also lists SharePoint, OneDrive, Box, Google Drive, Dropbox and NetDocuments, replacing the earlier absence of a named legal document system. ERP connections include SAP, Oracle, Workday and Coupa. Leah does not document field mappings, sync direction or permission inheritance for each connector, least of all for the document systems.
Document management systems are integrated rather than replaced. An iManage technology partnership works through iManage APIs, and SharePoint, Box, virtual data rooms and contract lifecycle systems feed documents in. Add ins bring the Agent and playbooks into Word and Outlook, EDGAR sits among the research sources, and MCP connectors and third party legal services feed the Agent's context. A plugin released on 17 September 2026 brings Legora's grounded answers into ChatGPT Enterprise. What each connection moves, in which direction and what an administrator configures is not documented.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Shared cloud delivery is standard, with single tenant deployment and a private Azure OpenAI environment available for additional isolation. The May 2026 subprocessor schedule adds region-specific hosting arrangements across Microsoft Azure, Google Cloud, and Oracle Cloud. Azure lists Europe, the United States, and Australia; Oracle also includes India, while Google lists Japan and several European jurisdictions. Model providers have their own location lists, selected according to the customer's hosting region where applicable. The schedule separates hosting from model services, but gives no complete per-customer map of storage, inference, backups, and support access across each product configuration.
Legora runs separate arrangements for the EU, the United States and Asia Pacific. Its subprocessor list sets out hosting and AI model providers by region, Microsoft, AWS and Google among them, with EU customers' data held in the EU and EEA. Storage is tiered to data sensitivity, technical teams in the EU and the United States support local clients, and subscriber environments are logically separated. No customer selection of region inside a tier is described, and where processing happens is not separated from where data is stored.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
A-LIGN's ISO/IEC 27001:2022 certificate covers the information security management system for design, development, operation, maintenance, and support of Leah CLM and Leah Legal as SaaS. Certificate ISMS-CO-032326 was issued March 23, 2026 and expires March 23, 2029. The trust portal provides the certificate directly, alongside a SOC 3 report covering the contract management and Copilot systems from October 2024 through September 2025. That report addresses security, availability, confidentiality, and privacy, with Azure and customer control dependencies excluded from the auditor's examination. Penetration-test material is also available. These attestations concern system controls, not the correctness of an AI legal recommendation.
ISO 27001:2022 with a yearly audit, SOC 2 Type II and ISO 42001 for the AI management system are all current. The trust center at security.legora.com carries a resources section and a data flow diagram, and the security whitepapers and security measures annex are published without a gate. Penetration tests run twice a year under an assume breach method. The certifying auditor is not named.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The May 2026 DPA lists Anthropic, OpenAI, Cohere, and Google AI/ML for Leah functionality, each with a no-storage or no-retention statement and defined processing jurisdictions. Azure supports hosting, translation, and Office services; Oracle and Google add hosting options. Zuva handles document intelligence, and ABBYY is limited to older CLM deployments. The platform routes tasks among language models and allows customer customization. New subprocessors require 30 days' notice, with an objection and termination route. Leah does not give model versions or say which provider produced a particular generated passage. The regional provider list describes available processing arrangements rather than a complete execution record.
The subprocessor list names Microsoft, AWS and Google for hosting, infrastructure and AI models and OpenAI for AI models, with DeepL for optional translation and Linkup Labs for web results, each with its residency. New subprocessors are announced by updating the list, with 30 days for the subscriber to object. An orchestration layer handles model selection across tasks. No model or model version is named, and nothing states which provider serves which feature.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The cloud service uses negotiated orders with a default 12-month subscription, automatic renewal, and 30-day nonrenewal notice. Standard, Gold, and Platinum support plans set different support hours, response targets, and availability commitments. Professional services require an order or statement of work, with possible travel expenses and separately quoted configuration work. AI access is described as unlimited subject to fair use, including restrictions on excessive compute, API calls, storage, and transfer. No subscription amount, seat rate, or implementation price is stated. For applicable European switching arrangements, an early termination charge can include the remaining subscription fees despite the right to transfer data.
No pricing page, rate, unit of charge or tier structure is published, and the commercial route is a demo request. The general terms are published openly, so contract terms can be read before a sales conversation even though price cannot.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Leah publishes dedicated industry pages for CPG and manufacturing, energy and utilities, financial services, healthcare, and pharma and medical devices. It describes its customers as Fortune 500 enterprises in regulated industries. By function it publishes pages for legal leadership, legal operations, sales and revenue, procurement, and finance. The pages carry distinct propositions written for the General Counsel, the contract operations team, the Chief Procurement Officer and the finance leader. The customer roster spans banking, airlines, pharmaceuticals, consumer goods and engineering. No published page says which practice areas, contract types or matters the platform does not support, and none addresses smaller organizations. Law firms appear only indirectly, through managed service partners, rather than as a served segment.
Large law firms, small and mid sized firms, in house legal departments, the public sector and professional services are all served, with solution pages for M&A, litigation, banking, insurance, private equity and tax. Multi jurisdiction and cross border work are stated strengths, with research sources across Europe and federal and state law in the United States. No firm size or practice area is named as outside its scope.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Attachment D permits use of inputs and outputs to train or improve AI features solely for the customer's benefit. The same agreement treats both as Customer Data. The trust portal excludes generalized model training, and the DPA says Anthropic, OpenAI, Cohere, and Google store or retain no Customer Data for Leah functionality. Private customer improvement is therefore permitted even though generalized training and retention by those model providers are restricted.
Under the heading Feedback, Usage Data and no training, Legora's general terms bar it from using a subscriber's confidential information to train or fine tune AI models and bar its subcontractors from doing so. Legora may use usage data to develop and improve the services, and shares it outside the company only when aggregated and anonymized. The home page and security page repeat the commitment as zero AI training on customer data.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Inputs and outputs are Customer Data under the AI terms. Export is available during the subscription, and deletion follows a request after termination within 60 days, with backup and legal exceptions. The DPA permits access, return, or deletion of personal data during service but sets no routine prompt history duration. Zero retention at named model providers does not define how long Leah keeps its own conversation, output, or audit records.
Section 17 of the security measures annex, dated 31 January 2025, keeps personal data under whatever retention the subscriber instructs during the data processing agreement, and clause 11 of that agreement governs return or deletion after it ends. No default retention period or zero retention setting is published. Backups of the full production environment run every four hours, and each subscriber's environment stays logically separate.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Leah describes role permissions, restrictions on the data agents may access, single tenant deployment and a private Azure OpenAI environment. Leah claims these controls separate customer information and limit access. Its trust portal also describes least privilege and reviews of staff access. The materials do not explain how retrieval enforces a barrier between separate legal matters inside one customer organization, or how permissions inherited from an external document system constrain an agent's answer. Corporate tenant isolation should not be assumed to provide a law firm's matter conflict controls.
Ethical walls and role based access control keep confidential information from crossing matters or projects, and full audit trails record every tool call, file access and agent action. Access control is built on the Zanzibar authorization model. How a wall is set up, and whether retrieval applies document management permissions per user at query time, is not described.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Section 19 permits legally required disclosure of confidential information, including Customer Data. Where law permits, the recipient must give reasonable advance notice and cooperate at the discloser's expense to seek confidential treatment. Inputs and outputs are covered as Customer Data under the AI attachment. The obligation therefore reaches customer AI material as well as uploaded contracts, without a separate transparency report or history of government demands accompanying it.
Either party may disclose confidential information under the general terms when law or an order of an authority, regulator or court compels it. The compelled party gives the other notice of the proceeding where the law allows and cooperates in seeking confidential treatment. The data processing agreement adds notice of any communication with a data protection authority about Legora's processing. No transparency report is published.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Answers and agent guidance draw on the customer's contracts, internal policies and playbooks. Those materials are an internal reference base, not an identified external legal corpus. The vendor also refers to established legal precedents, without naming a case law database, jurisdiction, publisher or licensing arrangement. No update schedule accompanies that reference. Source links to a customer's agreement can show where a commercial term came from, but say nothing about the provenance or rights basis of any external legal authority used in an answer.
Legora names the sources behind its research. Federal law and all 50 states in the United States are hosted on Legora, beside SEC EDGAR. European sources include France's Cour de cassation, Germany's federal statutes, Sweden's court portal, Lovdata, Retsinformation, Finland's legal database and Portugal's official gazette, and content partnerships bring in publishers. The Qura acquisition adds a Swedish database of case law, legislation and regulation. No license basis or update lag is stated for any source.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No citator, treatment signal or currency check is described, and nothing says whether legal authority is reviewed for later history. The platform manages contracts, obligations and procurement workflows rather than retrieving case law, so a citator is not part of what it sells. The vendor does refer to Leah operating against established legal precedents, without identifying any source. That is the one place the product invokes primary authority, and no verification step is described for it.
Legora is building its own AI native citator on an ontology of the law, announced on 14 September 2026. The ontology captures the hierarchy of authority, how sources relate and temporal validity, so an amended rule or an overruled case is recognized as such, and former publisher attorney editors set and audit the standard. The technology comes from the Qura and Wexler acquisitions. The citator is in limited beta, with general availability planned for the fourth quarter of 2026, and no coverage figure or error rate is published.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
The home page and the AI governance page describe no explicit path for Leah to decline to answer or abstain, and no confidence or grounding rating. The governance loop does produce rejections. Approvals, escalations and rejections are applied automatically according to the customer's rules. Those are policy outcomes set by configured guardrails, not the model declining because it cannot ground a response. Neither page says what Leah does when the customer's own contract set or playbook does not cover the question in front of it.
The Agent checks whether it met the goal and loops back to adjust, and research ranks sources by authority before answering. No explicit no answer path, abstention behavior or confidence value shown to the user is described.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
Neither Leah nor ContractPodAi appears in the AI Hallucination Cases database maintained by Damien Charlotin. Its entries concern court decisions involving hallucinated content, with tool names recorded where available. Leah's principal workflows cover commercial contracting, procurement, and related legal work rather than preparation of court submissions. That product setting helps explain the limited relevance of litigation records, but a missing entry is not a measure of the accuracy of its contract answers or redlines.
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming Legora or Leya. Legora's research checks findings against primary law, and its Tabular Review links every answer to the document it came from.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Leah publishes nothing that engages with bar or ethics guidance. That includes ABA Formal Opinion 512, state bar guidance in the United States, and Solicitors Regulation Authority or Law Society material. The company is headquartered in London and sells into legal departments across North America, Europe, Asia and Australia. Its published compliance material covers regulation and security frameworks, namely GDPR, CCPA, HIPAA, SOC and ISO. None of it addresses the professional conduct obligations that bind the lawyers using the product.
Material Legora publishes on its own AI governance and ISO 42001 certification engages none of ABA Formal Opinion 512, a state bar opinion or national bar guidance on lawyers' use of AI.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Leah serves corporate legal, contracting, procurement, and finance teams, and also supports legal services delivered to clients. Pinsent Masons Vario adopted the platform for its Managed Legal Services and Consulting work, including contracting support for customers' internal legal departments. Corporate efficiency figures concern operating cost, while the firm's use can affect client service delivery. The platform records agent actions and policy decisions, but gives no specific method for adjusting client fees or disclosing saved lawyer time.
Law firms and in house teams buy the product, and the customers page reports 80 percent of non billable hours saved weekly by experienced users and $6.4 million in additional billing per 100 lawyers a year. The small and mid sized firm page pitches more matters handled without more headcount. No record of AI assisted work by matter for fee purposes, and no billing or client disclosure guidance, is offered.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Attachment B includes the DPA, processing details, transfer mechanisms, and a subprocessor list by purpose, location, and product. Model providers are Anthropic, OpenAI, Cohere, and Google, alongside hosting, signatures, support, and integration suppliers. Codestone, Freshworks, Oracle, and Totango appear in the May 2026 list. New providers require 30 days' notice and permit objections. The AI terms separately disclose customer-specific training permission and require independent output review.
Legora publishes its subprocessor list by region, last updated 6 July 2026, naming Microsoft, AWS, Google and OpenAI as AI model and hosting providers with their purpose, data categories and residency, and offers email updates. Its general terms, data processing agreement, security measures annex and acceptable use policy are published without a gate. No client facing consent or notice pack is offered, and trust center documents come through a request.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
The audit stage of Leah's published governance loop logs every decision. Each entry records what the agent did, why, under which policy, with what data and with what outcome. The records are described as tamper resistant, immutable and ready for any audit. That gives the action, the rule, the inputs and the result for each action. The published description of the log does not include the model. The platform chooses among several language models for each task and identifies no model or version, so the log does not show which system produced a given passage.
No export built for court disclosure or AI use certification is described. The audit framing is regulatory and internal rather than judicial.
Full audit trails record every tool call, file access and agent action, Tabular Review cells link to their source documents, and Portal answers cite the exact source. No export for each document records the model used and the human verification, and no court disclosure template is offered.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Refusal and Uncertainty Behavior
- Bar Guidance Alignment
Product updates
The latest logged changes from each vendor, newest first, each linked to its source.
Legora
-
Product / capability
Legora launched Intake, available now in Slack.
Source -
Product / capability
Legora released Skills to all customers: Markdown instruction files, which can bundle templates and examples, that teach the Legora Agent a team's standards, processes and preferences.
Source -
Integration / interoperability
Legora connected to iManage Cloud.
Source
In summary
Leah
Leah is an agentic platform for contracting, legal, procurement and finance at large enterprises, sold by ContractPod Technologies of London and formerly known as ContractPodAi. It covers guided intake, playbook driven review and redlining in Microsoft Word, conditional approval routing with automatic escalation, execution through built in DocuSign and Adobe Sign, and a repository with obligation tracking. A skills based orchestration layer assigns the work to domain agents. According to the AI Legal Index, Leah's case rests on oversight and recourse. The customer defines which agents may act, on which data and within which thresholds, and every action is logged with its rationale and governing policy. Its master terms set a general liability cap at twelve months of fees, an enhanced cap at three times that figure, and an enumerated list of uncapped claims. It is sold on a custom quote.
Legora
Legora is a collaborative AI workspace for law firms and in house legal teams, founded in Stockholm in 2023 as Leya and renamed in February 2025. It is built around Tabular Review, a grid that turns large document sets into structured review with every cell linked to its source. A Microsoft Word add in handles drafting and redlining, alongside agentic workflows, legal research and a client facing Portal. According to the AI Legal Index, Legora's case rests on independent assurance. It holds ISO 27001:2022 audited yearly, SOC 2 Type II and ISO 42001 for its AI management system, and runs a public trust center with a data flow diagram. Its general terms, data processing agreement and security measures annex are published openly with no gate rather than behind a sales conversation. It is sold through a demo request.
Questions buyers ask
Are Leah and Legora alternatives to each other?
Sometimes, and this page says where they are not. Legora is a collaborative workspace sold to law firms and in house teams for review, drafting and research, a general legal assistant. Leah is an enterprise contracting platform sold to Fortune 500 legal, procurement and finance functions, built for contract review and drafting. Where they genuinely overlap is playbook driven contract review inside Microsoft Word, which both ship. Where they do not is everything on either side of it: Leah carries intake, approval routing, execution and obligation tracking, and Legora carries legal research, Tabular Review across large document sets and a client facing portal. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
What security certifications do Leah and Legora hold?
Legora holds ISO 27001:2022, SOC 2 Type II and ISO 42001 for AI management, publishes a trust center with a data flow diagram, and puts its general terms, data processing agreement and security measures annex out with no gate. Leah claims the longer list, including SOC 1 and SOC 2 at both Type I and Type II, but the same site contradicts itself about which of those are held. It identifies its auditor as an independent managed security service provider. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Do Leah or Legora train models on client data?
Both say no, in different places. Legora's general terms forbid it, and its subcontractors, from training or fine tuning AI models on customer data. Leah's security FAQ states that customer contract data is never used to train models, and its governance page commits to zero retention with OpenAI and Anthropic. Legora's commitment is contractual, and Leah's rests on policy. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Which one tells you what is underneath the product?
Leah, because it ties each provider to a function. Its data processing addendum names four model providers, Anthropic, OpenAI, Cohere and Google AI/ML, each listed against Leah functionality with the jurisdictions involved. Clause 4.3 requires a new subprocessor to be added to the published list at least thirty days before it processes customer personal data, with a thirty day objection right at clause 4.4. Legora's subprocessor list names its model providers, and a new subprocessor comes with 30 days to object. Both select across models per task. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Two things to weigh before reading this page as a shortlist. First, these two are not the same product class. Leah is an enterprise agentic platform for contracting across legal, procurement and finance functions, delivered in part through PwC, Epiq, Integreon and Pinsent Masons. Legora is a collaborative AI workspace sold to law firms and in house legal teams for review, drafting and research. The page exists because buyers search for the comparison. Second, the two sets of agreements differ in age and reach. The Leah master terms quoted here are version 3.0c, and the current version is 4.0. Several of Leah's commitments recorded here are stated on its governance page rather than in an agreement. Legora's commitment not to train on customer data is a term of its general terms. Neither vendor reviewed this page.