Legora vs Lucio: how they compare in 2026
The two share a shape, an assistant with Word and Outlook add ins, and part on scale, extras and price. Legora's aOS adds an Agent for multistep work, Tabular Review for data rooms, Workflows and Skills for a team's methods, Monitors, and Portal for client delivery. It holds ISO 42001 beside SOC 2 Type II and ISO 27001 and publishes no price. Lucio keeps to research, review and drafting. Its Briefcase reads a whole record, chronologies tie each event to the page, a review mode tests a draft argument, and competition lawyers get curated decisions from six regulators. It costs $149 per user a month with onboarding included, and data can stay in India, the UK, the UAE or the United States. Legora is the stronger fit for a firm that delegates multistep work to an agent and shares workflows with clients. Lucio fits a firm in India or the Gulf, or a smaller firm elsewhere, that wants cited research and Word drafting at a published price.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Everything Legora sells is generative. The Agent plans and executes legal work across the platform's tools, Tabular Review extracts answers from each document into a grid, research answers questions across jurisdictions, and drafting runs in Word, Outlook and the built in editor. An orchestration layer handles tool routing, memory, model selection and guardrails beneath them. Without the models there is no product left to sell.
Each of the three products is model work. The Assistant answers research questions across case law, statutes and the firm's own files, and it reads a whole Briefcase of documents at once. It builds chronologies with each event tied to its source, compares testimonies and statements, and runs a review mode that looks for weaknesses in a draft argument. In Word, Lucio generates clauses and revisions and compares each clause with the firm's preferred language. In Outlook, it reads threads with their attachments, drafts replies in the lawyer's voice and writes work summaries from sent email for time entries. Prompt libraries, agents tuned to a practice area and fill in templates for regulatory forms sit on top, with Tab to Enhance rewriting a rough prompt into a better one. There is no matter management or billing layer of its own, and documents come from the firm's existing systems.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Each cell in Tabular Review expands to its reasoning and the source documents behind it, and Portal answers carry links back to the exact source. Legal research works several sources in parallel, ranks them by authority and checks each finding against primary law before the answer returns. The rebuilt research layer announced on 14 September 2026 runs on an ontology of the law that maps how authorities rank and relate, including amendments and temporal validity. Its AI native citator follows a standard set and audited by former publisher attorney editors. Legora says it has cataloged more than 50 ways AI fails at legal research without publishing the list. The layer is in limited beta, and no accuracy figure, evaluation framework or hallucination rate is published.
Every output carries source citations, and answers drawn from uploaded files cite back to the page or line they came from. Research runs over curated repositories for each jurisdiction and, in competition work, over decisions from the EC, the FTC, the CMA, CADE, the CCI and the ACCC, with research mode also querying the web. Where an answer is not in the file, Lucio says so rather than supplying one. The product terms describe output as probabilistic and possibly inaccurate or incomplete. Measured accuracy, a test set and failure analysis are not published, and the case law collections behind research are not named.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The Agent proposes a plan before it acts, carries out the work across documents, data sources and tools, checks whether it met the goal, and delivers work product into the project workspace for the lawyer's review and approval. It can also act without being asked, watching email, documents and projects and starting work when something needs attention. Tabular Review adds Mark as Reviewed, Lock Cells and Review Mode for team review, and full audit trails record every tool call, file access and agent action. ISO 42001 covers the AI management system, with human oversight named as a principle. No threshold at which the Agent stops for a person, and no route after a wrong output, is described.
Edits land in Word as tracked redlines, so the lawyer accepts, rejects or refines each change, and Outlook replies show every AI edit in redline before sending. Lucio describes itself as a research and drafting accelerator in which the lawyer signs the brief and confirms each citation in the record before it reaches a court. Under the product terms, every output must be reviewed and verified by a competent professional before anyone relies on it, and high risk or safety critical use without expert human oversight is prohibited. Agents and prompt libraries are set up per practice by Lucio's legal engineers during onboarding. What the agents may run without a person, any point at which they stop, and what follows a wrong output are not described.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Legora counts more than 1,800 teams in over 50 markets and 100,000 lawyers on the platform. Named customers include White & Case, Crowell, Accor, Dentons Europe, Trowers & Hamlins and Grant Thornton UK, whose forensic investigations team has a published story. The customers page reports that users see a 25 percent improvement in work quality, that experienced users save 80 percent of non billable hours weekly, and that firms bill $6.4 million more per 100 lawyers a year. None of those figures carries a date, sample or method. An in house study with the analyst Ari Kaplan drew on conversations with 30 customers in nine countries.
Trilegal, an Indian firm of about 1,200 lawyers, onboarded in 2023 and now has seats across the firm, with its 31 lawyer competition group as the first cohort and partner Gautam Chawla quoted on the rollout. Stubbs Alderton & Markiles, a 45 lawyer technology firm in Southern California, describes Lucio as everyday software, and its CEO reports that a heavy user's billable hours rose after adoption. Becket McGrath of Euclid Law and Kevin Cooper of Hadef & Partners are quoted by name. By its own count, more than 250 law firms and in house teams use the product. It claims about 30 hours saved per lawyer each month and a doubling of productivity, with no method or customer attached to those figures.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The general terms bar Legora from using a subscriber's confidential information to train or fine tune AI models and require the same of its subcontractors. The terms, the data processing agreement and the security measures annex are published in versions for the EU and the United States, and the annex covers least privilege access, personnel confidentiality, authorization controls and retention on customer instruction. Ethical walls and role based access are stated to keep confidential information from crossing matters or projects, on access control built on the Zanzibar authorization model, and engineers reach customer data only with the customer's written approval. Privilege and work product handling are not addressed.
Clause 7.4 of the product terms bars using customer data to train or enhance AI models, or for any third party's benefit, unless the user authorizes it. Data is processed only to provide the contracted services, the customer owns its inputs and receives the rights in its outputs, and client data sits in a dedicated tenant encrypted at rest and in transit. Personnel access is limited to privileged users, logged and revoked within 24 hours of a role change. The data processing agreement redirects government requests to the customer and gives notice where the law allows. Privilege and work product are not named, segregation between matters inside a firm is not described, and what the model providers behind the product retain is not stated.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Legora sells to lawyers, firms and in house teams and describes the product as working with lawyers rather than replacing them, with the Agent's output delivered for a lawyer's review and approval. No position on the advice line, no treatment of competence and supervision duties and no jurisdiction limit appears in the acceptable use policy, the general terms or the product pages.
No legal advice, opinion or recommendation comes from the product, which creates no lawyer client relationship and is no substitute for advice from a professional, as the product terms put it. Customers may be individual practitioners, law firms, chambers or other organizations. Where the product is used in legal practice, the user stays responsible for rules of professional conduct and bar and regulatory requirements. Client confidentiality and the duty of competence also stay with the user, and every output must be verified by a competent professional before reliance. Supervision of junior staff is not addressed, and no jurisdiction is named as outside the product's limits.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Legora holds ISO 42001 for its AI management system, independently audited with ongoing surveillance, and publishes what the certification covers: how AI is designed, deployed, supervised and monitored, with human oversight and structured governance as the operating principles. No internal owner of AI governance is named, no results of testing on model behavior before release are published, and nothing covers uneven output across matter types, parties or populations.
Responsible legal AI is how Lucio describes its aim, and its trust center lists a no use for AI training control, a risk management policy, a secure development lifecycle and an incident response plan among its controls. These are security and data controls rather than AI governance. No governance framework, release testing, accountable owner or finding about uneven output across practice areas, languages or jurisdictions is published. The information security program is reviewed at least once a year and cannot be changed in a way that materially weakens it.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The security measures annex sets least privilege and role based access, and centrally stored logs traceable to unique usernames, with security logs kept at least 12 months. It adds data integrity signing, background checks and confidentiality agreements for staff, and retention as the customer instructs. Subscriber environments are logically separated and full production backups run every four hours. The data processing agreement has Legora report a personal data breach within 36 hours and delete or return personal data at the subscriber's choice when it ends. The subprocessor list, last updated 6 July 2026, names each provider with its purpose, data and residency, and a new subprocessor comes with 30 days to object. Penetration tests cover the full platform twice a year.
The data processing agreement and the technical and organizational measures are published. Customers can retrieve or delete their data in the product at any time, and Lucio deletes whatever remains on termination or on request, subject to statutory archiving. A personal data breach is notified without undue delay. Subprocessors are kept on the trust center and changed only after at least 30 calendar days' notice, with a right to object and to terminate with a refund. They include OpenRouter, Microsoft Azure, Google Cloud Platform and MongoDB. Access runs on role based controls with multifactor authentication and single sign on. Privileged access is logged and removed within 24 hours of a role change, and staff with that access take role specific training. Cloud snapshots back up customer data, and vulnerability management, static code analysis and a bug bounty are in place.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
General terms and conditions are published openly in an EU version and a version for the United States. They carry numbered liability clauses, aggregate caps that apply across the subscriber and its affiliates, a separate cap of €100,000 on beta features, and a carve out the terms call an Enhanced Claim. No indemnity for third party claims arising from output, warranty on output or insurance position is stated.
Total liability is capped at the subscription fees paid in the 12 months before the claim, and indirect, consequential and punitive damages are excluded for both parties, under product terms governed by Indian law. The products and all output are provided as is, with every warranty disclaimed, including accuracy. The customer indemnifies Lucio, and no indemnity runs from Lucio to the customer. A bespoke master services agreement exists for larger customers but is not public.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Legora integrates with document management systems rather than replacing them. An iManage technology partnership works through iManage APIs, and SharePoint, Box, virtual data rooms and contract lifecycle systems feed documents in. Add ins bring the Agent and playbooks into Word and Outlook, EDGAR sits among the research sources, and MCP connectors and third party legal services feed the Agent's context. A plugin released on 17 September 2026 brings Legora's grounded answers into ChatGPT Enterprise. What each connection moves, in which direction and what an administrator configures is not documented.
Add ins put the product inside Word and Outlook, and connectors reach iManage, NetDocuments, SharePoint, OneDrive and Dropbox, with a short video guide to the NetDocuments connection. In Word, clauses and revisions arrive as tracked changes and playbook comparisons sit beside the document. Fill in templates populate placeholders in filing drafts from the source documents. In Outlook, threads and attachments are read together, and work summaries can be filtered by day, week or matter and copied into a timesheet tool. Single sign on is supported. What each document system connection reads or writes back, and how its permissions carry over, is not described.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Legora runs separate arrangements for the EU, the United States and Asia Pacific. Its subprocessor list sets out hosting and AI model providers by region, Microsoft, AWS and Google among them, with EU customers' data held in the EU and EEA. Storage is tiered to data sensitivity, technical teams in the EU and the United States support local clients, and subscriber environments are logically separated. No customer selection of region inside a tier is described, and where processing happens is not separated from where data is stored.
Microsoft Azure and Google Cloud host the product, or the customer can run it on infrastructure it deploys itself, with client data in a dedicated tenant. Storage follows the region the customer declares at sign up. Customers in the United Kingdom are stored there, and the same holds for the UAE, the United States and India. EU customers and the rest of the world are stored in the United Kingdom, and without a declaration the default is India. Data may pass through other jurisdictions for transient processing without being retained there, so processing and storage locations are stated separately. One subscription covers every product, so no tier changes these terms.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
ISO 27001:2022 with a yearly audit, SOC 2 Type II and ISO 42001 for the AI management system are all current. The trust center at security.legora.com carries a resources section and a data flow diagram, and the security whitepapers and security measures annex are published without a gate. Penetration tests run twice a year under an assume breach method. The certifying auditor is not named.
SOC 2 Type II and ISO 27001:2022 are both held, beside stated compliance with GDPR, UK GDPR, India's DPDP Act, the CCPA and the UAE's data protection law. Controls, policies and reports, including a disaster recovery drill, a vulnerability assessment and static code analysis, sit in a trust center, and documents are released after an access request. Lucio says certifications and reports are available to customers and to their own clients. The auditor and report dates are not shown on the public view.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The subprocessor list names Microsoft, AWS and Google for hosting, infrastructure and AI models and OpenAI for AI models, with DeepL for optional translation and Linkup Labs for web results, each with its residency. New subprocessors are announced by updating the list, with 30 days for the subscriber to object. An orchestration layer handles model selection across tasks. No model or model version is named, and nothing states which provider serves which feature.
The subprocessor list names OpenRouter in the United States, a router to third party models, beside Microsoft Azure in the United States, the UAE and the United Kingdom and Google Cloud Platform in the United States. The models themselves, and which provider serves which product, are not named. Any new or replacement subprocessor is announced at least 30 calendar days ahead, with a right to object and to leave with a refund of prepaid fees. A change of model behind the same router would not appear on that list. Customer data does not train any model under the product terms.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
No pricing page, rate, unit of charge or tier structure is published, and the commercial route is a demo request. The general terms are published openly, so contract terms can be read before a sales conversation even though price cannot.
One subscription covers the Assistant, the Word add in and the Outlook add in at a flat $149 per user a month, with no seat minimum and no fees. Training, onboarding by Lucio's legal engineers, every integration, prompt libraries and templates, and access to current and future legal repositories are included. Use is subject to a fair usage clause that rules out automated or excessive use. Tailored arrangements are handled by email, and larger customers can sign a bespoke master services agreement. The pricing page itself asks visitors to sign up to see the price, and the figure appears in the published answers about cost.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Legora serves large law firms, small and mid sized firms, in house legal departments, the public sector and professional services, with solution pages for M&A, litigation, banking, insurance, private equity and tax. Multi jurisdiction and cross border work are stated strengths, with research sources across Europe and federal and state law in the United States. No firm size or practice area is named as outside its scope.
Boutique, mid sized and enterprise law firms and in house legal teams make up the customer base, with users in 13 jurisdictions and data regions for India, the UK, the UAE and the United States. Practice versions cover disputes and litigation, corporate and transactions, banking and regulatory, and competition. Litigation teams get discovery across a Briefcase, chronologies, argument review and testimony comparison, and competition lawyers get curated decisions from six authorities for merger research. Multilingual review and translation serve cross border matters, and OCR reads scanned filings and older documents. Practice areas and jurisdictions outside its range are not stated.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Under the heading Feedback, Usage Data and no training, Legora's general terms bar it from using a subscriber's confidential information to train or fine tune AI models and bar its subcontractors from doing so. Legora may use usage data to develop and improve the services, and shares it outside the company only when aggregated and anonymized. The home page and security page repeat the commitment as zero AI training on customer data.
Clause 7.4 of the product terms bars using customer data to train or enhance AI models, or for the benefit of any third party, unless the user explicitly authorizes it. Data is processed only to provide the contracted services, the customer keeps ownership of its inputs and outputs, and no use for AI training appears among the trust center's data controls. The terms separately forbid customers from using Lucio's output to train their own models.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Section 17 of the security measures annex, dated 31 January 2025, keeps personal data under whatever retention the subscriber instructs during the data processing agreement, and clause 11 of that agreement governs return or deletion after it ends. No default retention period or zero retention setting is published. Backups of the full production environment run every four hours, and each subscriber's environment stays logically separate.
Customers can retrieve or delete their data in the product at any time, and on termination or request Lucio deletes whatever the customer has not, subject to statutory archiving. Data passing through another region for processing is not retained there. Cloud snapshots back up customer data in the region where it is stored. No fixed retention window and no zero retention setting for prompts and outputs are described.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Ethical walls and role based access control keep confidential information from crossing matters or projects, and full audit trails record every tool call, file access and agent action. Access control is built on the Zanzibar authorization model. How a wall is set up, and whether retrieval applies document management permissions per user at query time, is not described.
Each customer's data sits in a dedicated tenant, is not visible to anyone without the customer's consent, and is governed by role based access control, with any staff access logged. Briefcases group the documents for one case, and Outlook summaries can be filtered by matter. How matters are walled off from one another inside a firm, and whether access follows the permissions in iManage or NetDocuments, is not described.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Legora's general terms let a party disclose confidential information when law or an order of an authority, regulator or court compels it. The compelled party gives the other notice of the proceeding where the law allows and cooperates in seeking confidential treatment. The data processing agreement adds notice of any communication with a data protection authority about Legora's processing. No transparency report is published.
Under section 6 of the data processing agreement, Lucio first tries to redirect a government body's binding order to the customer. If it is still compelled to disclose, it notifies the customer promptly where the law allows, so the customer can seek a protective order or another remedy. No transparency report is published, and the clause covers personal data under the agreement.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Legora names the sources behind its research. Federal law and all 50 states in the United States are hosted on Legora, beside SEC EDGAR. European sources include France's Cour de cassation, Germany's federal statutes, Sweden's court portal, Lovdata, Retsinformation, Finland's legal database and Portugal's official gazette, and content partnerships bring in publishers. The Qura acquisition adds a Swedish database of case law, legislation and regulation. No license basis or update lag is stated for any source.
Research draws on curated repositories for each jurisdiction. For competition work it adds decisions from the European Commission, the FTC, the CMA, CADE, the CCI and the ACCC, which show how regulators treated similar transactions, remedies and market definitions. Research mode can also query the web and the firm's own precedents. The case law collections for each jurisdiction, the rights basis for each source and how often they are updated are not stated.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Legora is building its own AI native citator on an ontology of the law, announced on 14 September 2026. The ontology captures the hierarchy of authority, how sources relate and temporal validity, so an amended rule or an overruled case is recognized as such, and former publisher attorney editors set and audit the standard. The technology comes from the Qura and Wexler acquisitions. The citator is in limited beta, with general availability planned for the fourth quarter of 2026, and no coverage figure or error rate is published.
Research answers cite the case or statute behind them, and answers about uploaded files cite the page they came from. Lucio describes the lawyer as confirming each citation in the record before it reaches a court. No treatment flag, subsequent history check or link to a citator is described, and the review mode that tests a draft argument surfaces cases against the position rather than their current status.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
The Agent checks whether it met the goal and loops back to adjust, and research ranks sources by authority before answering. No explicit no answer path, abstention behavior or confidence value shown to the user is described.
Answers about uploaded documents are grounded in those files and cited to the source line, and where the answer is not in the file the product says so instead of inventing authority or quotes. No published evaluation shows how often this happens, and research answers drawn from the web are not described the same way.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming Legora or Leya. Legora's research checks findings against primary law, and its Tabular Review links every answer to the document it came from.
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming Lucio or Zenlegal. Lucio cites every answer to its source and leaves verification before filing to the lawyer.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Legora publishes material on its own AI governance and ISO 42001 certification, and none of it engages ABA Formal Opinion 512, a state bar opinion or national bar guidance on lawyers' use of AI.
Professional conduct rules, bar and regulatory requirements, client confidentiality and the duty of competence stay with the user under the product terms, which say Lucio takes on none of them. No ethics opinion from the bars of India, the United States, the UK or the UAE is discussed, and no mapping of the product to such guidance is published. Lucio's customer stories discuss AI adoption in practice without citing professional rules.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Legora sells to law firms and in house teams, and its customers page reports 80 percent of non billable hours saved weekly by experienced users and $6.4 million in additional billing per 100 lawyers a year. The small and mid sized firm page pitches more matters handled without more headcount. No record of AI assisted work by matter for fee purposes, and no billing or client disclosure guidance, is offered.
Sold to law firms, the product is pitched on about 30 hours saved per lawyer each month, more billable work per associate and less non billable preparation time. Its Outlook add in turns sent email and attachments into work summaries that can be filtered by matter and copied into a timesheet tool. Nothing marks which work the AI did, and no guidance on billing or disclosing AI assisted work is published.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Legora publishes its subprocessor list by region, last updated 6 July 2026, naming Microsoft, AWS, Google and OpenAI as AI model and hosting providers with their purpose, data categories and residency, and offers email updates. Its general terms, data processing agreement, security measures annex and acceptable use policy are published without a gate. No client facing consent or notice pack is offered, and trust center documents come through a request.
Subprocessors are listed on the trust center with their countries, including OpenRouter, Microsoft Azure, Google Cloud Platform and MongoDB, and the data processing agreement promises 30 days' notice of any change. Lucio says its certifications and reports can be shared with customers and their own clients through an access request, and a bespoke master services agreement is available for larger firms. No ready client facing disclosure pack is published.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Full audit trails record every tool call, file access and agent action, Tabular Review cells link to their source documents, and Portal answers cite the exact source. No export for each document records the model used and the human verification, and no court disclosure template is offered.
Answers cite back to the page, chronologies tie each event to its source document, and Word edits stay visible as tracked changes. Lucio keeps logs of staff access to customer data, and work summaries from Outlook can be grouped by matter. No export records the model used, the sources retrieved and the person who verified a filing, and no court disclosure template is published.
Which one fits
Choose Legora if
- You run reviews across hundreds of documents with a team. Tabular Review lays out documents as rows and questions as columns, with each cell opening to its source.
- You want an agent that carries work to a deliverable. Legora's Agent plans and executes multistep work across documents and tools, following Skills that hold a team's standards.
- Clients should run your workflows themselves. Portal gives them a branded workspace to use the firm's methods and get cited answers.
Choose Lucio if
- You want a published per user price. Lucio charges one monthly rate for all three products, with onboarding and integrations included and no minimum seats.
- Your practice is competition law. Lucio's competition version draws on curated decisions from the European Commission, the FTC, the CMA, CADE, the CCI and the ACCC.
- You litigate from a large record. A Briefcase holds the whole case file, chronologies cite each event to its source, and review mode looks for the weaknesses in a draft argument.
In summary
Legora
Legora, the Stockholm company behind aOS, sells collaborative legal AI to law firms, legal departments and public bodies. Tabular Review, the Agent and Workflows handle document heavy and multistep work, while Lists and Monitors keep matters organized and current. According to the AI Legal Index, Legora's access control runs on the Zanzibar authorization system, customers can bring their own encryption keys, and no customer data trains or fine tunes its models.
Lucio
Lucio, made by Zenlegal Technology in Bengaluru, combines a research and review assistant with Word and Outlook add ins in one subscription, and Trilegal uses it across the firm. According to the AI Legal Index, Lucio's product terms prohibit training on customer data, and storage follows the customer's declared region. Subprocessors such as OpenRouter and Microsoft Azure are listed with 30 days' notice of change, and it holds SOC 2 Type II and ISO 27001:2022.
Questions buyers ask
Legora or Lucio for a mid sized firm?
Legora suits firms that want an agent, tabular review and a client portal and can work through a sales process. Lucio suits firms that want research, review and drafting inside Word and Outlook at a flat published rate, with data held in India, the UK, the UAE or the United States. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Do Legora and Lucio work inside Word and Outlook?
Each has Word and Outlook add ins. Legora's sit beside its own editor, mobile app and Portal. Lucio's Word add in compares clauses with the firm's playbook in tracked changes, and its Outlook add in summarizes sent email by matter for time entries. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
How do they keep client data out of model training?
Legora commits not to use customer data to train or fine tune any AI model. Lucio's product terms bar using customer data to train or enhance AI models unless the user authorizes it, and its data processing agreement lists subprocessors with 30 days' notice of change. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Which certifications do Legora and Lucio hold?
Legora holds ISO 42001, ISO 27001 and SOC 2 Type II and states GDPR and HIPAA compliance. Lucio holds SOC 2 Type II and ISO 27001:2022 and states compliance with GDPR, UK GDPR, India's DPDP Act, the CCPA and the UAE's data protection law. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Legora took its current name in 2025, two years after starting in Stockholm as Leya. Lucio is built by Zenlegal Technology, whose seed round was led by DeVC, and trade press has paired it with Legora and Harvey. Neither vendor reviewed this page.