Legora vs Luminance: how they compare in 2026

The models are the product. The workspace is AI native rather than a document system with a model attached, and every surface the vendor sells, review, drafting, research and workflows, is a generative capability. Remove the models and nothing remains to sell.

The artificial intelligence is the product, and the vendor owns more of the stack than almost anyone on this index. Founded by mathematicians in 2015, it runs a multi model architecture it calls a Panel of Judges combining foundation, fine tuned and proprietary models, and ships its own legal intelligence model, Luna Crescent, trained in house and deployed in its own environment. Remove the models and there is no product.

Grounding is documented in vendor material, short of any figure an outsider can test. Review output links each cell to its source. On 14 Sep 2026 the vendor published how its rebuilt research layer works: an ontology of the law that maps how authorities rank and relate, including amendments, holdings against dissents and temporal validity, and an AI native citator whose standard is set and audited by a team of former publisher attorney editors, built on technology from its Qura and Wexler acquisitions. The vendor also states it has catalogued more than 50 distinct ways AI fails at legal research, without publishing the list. The research layer is in limited beta, with general availability planned for the fourth quarter of 2026. Not located as of 24 Sep 2026: a published accuracy measurement, an evaluation framework or a hallucination rate, which is what separates this from an A.

Substantive disclosure with a real gap. The vendor publishes ContractIQ Bench, a proprietary benchmark of 189,000 manually annotated and reviewed data points assessing interpretation of named provision types including liability caps, termination for convenience and confidentiality obligations, tested on held out documents and concepts excluded from training, with blind evaluations by legal experts alongside. It publishes a result, 5 percent higher accuracy than leading general purpose models on contract understanding, and a speed figure of 200 to 400 tokens per second. It also states a design principle directly relevant to this axis: the model is trained to prioritise faithful extraction and to identify absence rather than invent an answer. Two gaps keep it off an A. The published figure is a relative delta with no absolute accuracy rate and no named comparator models, so a reader cannot tell what 5 percent higher is 5 percent higher than. And the benchmark is proprietary, with no sample tasks or rubric published, so an outsider cannot inspect or re run it.

Human oversight is asserted as a governing principle in vendor material and is covered in the abstract by an ISO 42001 certification of the AI management system. What is not published is the mechanism: where the review point sits, what an agentic workflow does on its own, at what threshold it stops, and what a supervising lawyer must approve. Searched the vendor site, blog and trust center on 29 Aug 2026. Oversight appears as a stated principle rather than a described control.

A real published commitment with a described control mechanism, short of the full structure. The Panel of Judges architecture is itself an oversight design and is documented: multiple models analyse each clause independently and reach consensus, which the vendor states reduces hallucination risk. Outputs are described as traceable, and Traffic Light Analysis ranks deviation risk visually so a reviewer sees where to look. The vendor publishes a position piece arguing that human in the loop alone is insufficient and that systems must be designed for accuracy and transparency, which is a real stated philosophy rather than a slogan. Not located as of 29 Aug 2026: where the review point sits when the product negotiates with a counterparty directly, the threshold at which it escalates to a lawyer, and what the vendor commits to when an output is wrong. That first gap matters here more than for most, because the product sends agreements to counterparties and negotiates on the customer's behalf.

Named customers appear in vendor material, including a published Grant Thornton UK forensic investigations story, and the vendor states more than 1,000 customers across 50 plus markets. Additional named users including Cleary Gottlieb, Goodwin, Linklaters, White and Case, Dentons and Barclays appear in vendor recruiting material. Not located as of 29 Aug 2026: dated outcome figures with a method a reader could assess, which is what separates this from an A.

Real deployment evidence with substance, short of attribution and method. Named customers appear in vendor and trade material including Hitachi, AMD, BBC Studios, Yokogawa and Koch, alongside a stated base of more than 700 organisations across 70 plus countries and all four of the Big Four consultancies. A customers page is published. The recurring figure, negotiation time reduced by up to 90 percent, is a vendor claim carrying a hedge and is not tied to any named customer, dated, or accompanied by a method. Searched the site, the customers page, the press releases and the resources index on 29 Aug 2026 and located no case study pairing a named organisation with figures and a date.

Substantive published commitments, and unusually for this market they sit in openly published contract documents rather than only on a trust page: general terms and conditions in EU and US versions, a data processing agreement, and a security measures annex covering least privilege access, personnel confidentiality obligations, authorization controls and retention on customer instruction. The security page states the vendor will not use customer data to train or fine tune models. Two gaps hold this off an A. Attorney client privilege and work product handling is not addressed directly in located material, and matter level segregation between users is not documented.

Substantive published commitments, short of the full picture. Segregation is the strongest element and is documented precisely: each customer receives a dedicated single tenant instance with complete isolation and no co mingling of data, which exceeds the level this buyer segment requires under the amended band. Access control is documented at an unusual depth, including that vendor staff cannot view customer documents without explicit authorisation given through the user interface, with all access tracked and audited. Encryption is specified to the key management service, cipher and rotation practice. Two gaps hold this off an A. No training prohibition on customer content was located anywhere in vendor material, which is a conspicuous absence for a vendor that trains its own models and publishes a corpus figure of 220 million legal documents. Attorney client privilege and work product handling is not addressed directly.

The intended audience is unambiguously lawyers, firms and in house teams, and vendor material describes the product as working with lawyers rather than replacing them. Searched the vendor site, the published acceptable use policy, the general terms and the blog on 29 Aug 2026 and located no published position on the advice line, no treatment of competence and supervision duties, and no statement of jurisdiction limits.

A boilerplate structure sits in the terms while the product is sold well beyond lawyers. Dedicated solution pages target compliance, executive, sales, procurement, finance, human resources and marketing teams alongside legal, and the product negotiates contracts on a customer's behalf. Searched the site, the solution pages, the published terms and conditions, the privacy policy and the resources index on 29 Aug 2026 and located no position on advice versus tooling, no treatment of competence or supervision duties, and no statement of jurisdiction limits, despite operation in more than 70 countries. This is the widest version of the non lawyer distribution question on the index so far, since the tool is marketed to marketing and HR departments.

Holds an ISO 42001 certification covering its AI management system, independently audited with ongoing surveillance, and publishes what the certification covers: how AI is designed, deployed, supervised and monitored, with human oversight and structured governance named as the operating principles. That is a published governance framework with real substance and independent validation, which is rare in this market. Not located as of 29 Aug 2026: a named internal owner of AI governance, published pre release testing results for model behaviour, or any disclosure about uneven output across matter types, parties or populations.

Principles and architecture are published without a governance mechanism a buyer could audit. What exists is real and substantial: a published white paper on how the AI is built, a named Director of AI who authors technical material under his own name, a Cambridge based research team, a described validation regime through ContractIQ Bench, and a security advisory board of named external experts. But the security advisory board governs security rather than model behaviour, and no equivalent exists for AI governance. Not located as of 29 Aug 2026: a named owner of model governance, a pre release testing gate as distinct from benchmark results, an AI management certification such as ISO 42001, and anything on uneven output across matter types, parties or populations.

The published security measures annex covers access on a least privilege and role based model, centrally stored logs traceable to unique usernames with security logs retained at least 12 months, data integrity signing, personnel background checks and confidentiality agreements, and retention set by customer instruction. The published data processing agreement commits the vendor to assist with the customer's own breach notification obligations, so incident practice is addressed. ISO 27001:2022 is audited yearly. Not located as of 29 Aug 2026: a current named subprocessor list, which is the remaining element of the A bar.

Substantive published policy covering most of the ground, at an unusual level of specificity. Published in the security FAQ: AWS Key Management Service encryption at S3 and EC2 level with AES-256 keys rotated regularly, TLS 1.2 or higher in transit, dedicated single tenant instances, role based and division level permissions configured by the customer under least privilege, configurable password and session timeout policy, mandatory staff security training, named threat detection through Darktrace's Enterprise Immune System and Juniper firewalls, and a described incident management process covering detection, mitigation and communication. Backups are stated precisely: nightly to a secondary AWS data centre in the same region, encrypted, retained a minimum of 14 days. Not located as of 29 Aug 2026: a retention period or deletion control for customer documents in normal operation as distinct from backups, and a named subprocessor list.

A real published position, which is uncommon here. General terms and conditions are published openly in EU and US versions and carry numbered liability clauses, aggregate caps that apply across the subscriber and its affiliates, a separate cap of 100,000 Euro on beta features, and a carve out concept the terms call an Enhanced Claim. A buyer can read the allocation of loss before entering a sales process. Not located as of 29 Aug 2026: indemnity scope for third party claims arising from output, any warranty on output, and any insurance position, so the full picture is short of an A.

Liability is addressed only through published terms carrying a standard structure. Terms and conditions are published openly alongside a privacy policy, cookie policy and anti slavery statement, so a buyer can read the allocation of loss before entering a sales process, which keeps this above a pure absence. Searched those documents, the security page and the security standards white paper entry point on 29 Aug 2026 and located no indemnity running to the customer for third party claims arising from output, no warranty on output, no stated liability cap figure and no insurance position. Worth noting the product negotiates with counterparties on a customer's behalf, which raises the recourse question more sharply than a review only tool.

Real and named integrations: an iManage technology partnership working through iManage APIs with an announced expansion, SharePoint, Box, a Microsoft Word add in for drafting and redlining, Outlook, EDGAR, and import from virtual data rooms and contract lifecycle systems. On 17 Sep 2026 the vendor released a plugin for ChatGPT Enterprise that brings its grounded answers into the ChatGPT interface. The vendor is explicit that it integrates with document management systems rather than replacing them. Not located as of 29 Aug 2026: implementer level documentation describing what each integration moves, in which direction, and what an administrator must configure, which is what the A bar asks for.

Integrations are asserted at platform level with no documentation an implementer could use. The vendor describes connecting intake, negotiation, workflow and repository intelligence in one platform, and a Collaborate product exists for working with counterparties, and third party sources reference Microsoft Word and Outlook working surfaces. What was not located on the vendor's own property as of 29 Aug 2026, after checking the platform pages, the technology page, the security page and the resources index, is any integrations page, any named connector for document management, contract lifecycle, e signature, CRM or ERP, and any description of what an integration moves or what an administrator configures. For an enterprise platform sold to procurement and finance functions, that absence is notable.

The claim is made and the detail is not published. Vendor material states flexible storage options matched to data sensitivity, and separate EU and US contract documents indicate region specific arrangements, with the technical team in Sweden operating under GDPR. Searched the vendor site, the security pages and the published legal documents on 29 Aug 2026 and located no list of available regions, no tenancy model, and no statement of where processing happens as distinct from where data is stored.

Deployment model is stated clearly with partial residency detail. Three things are published and specific: a dedicated single tenant AWS instance per customer with complete isolation, deployment within the customer's own environment as an alternative to the hosted option, and backup to a secondary AWS data centre within the same region, which confirms data stays in region. The vendor states AWS global infrastructure provides a solution tailored to geographic requirements. What is missing is the list: no named available regions, no statement of which regions a customer may select, and no statement of where processing happens as distinct from where data is stored. The single tenant and on premises options are genuinely stronger than most of this index.

Three current independent certifications, ISO 27001:2022 audited yearly, SOC 2 Type II, and ISO 42001 for AI management, with a public trust center at security.legora.com carrying a resources section and a data flow diagram, plus security whitepapers and a security measures annex published openly with no gate at all. The open publication of the security annex is full credit rather than a request flow. The certifying auditor is not named in located material, which is the one thing a peer in this category does publish.

Certification is real and stated with correct nouns, short of accessible evidence. ISO 27001:2022 is named with its version and described as certification, and the SOC 2 Type 2 language is precise: the vendor says successful completion of a SOC 2 Type 2 examination assessing controls related to security, availability and confidentiality, which is the correct noun for SOC 2 and names the trust services criteria in scope. That is more careful phrasing than most vendors on this index manage. Regular independent third party penetration testing is stated. A named external security advisory board including a former Director General of MI5 and two former Darktrace executives is published with full biographies. What is missing is the evidence route: no trust portal was located, no report is downloadable or requestable through a published flow, and no coverage period, report date or auditor name was located as of 29 Aug 2026. A security standards white paper is published, which is the nearest thing to an evidence route.

Vendor material refers to how it implements, supervises and evolves AI without identifying what sits underneath. Searched the vendor site, the trust center, the published general terms, the data processing agreement and the security measures annex on 29 Aug 2026 and located no named model provider, no subprocessor list and no commitment to notify customers when the supply chain changes. Third party sources describe a multi model approach running on Microsoft Azure, which is not vendor material and does not move this axis.

The supply chain is partly disclosed and the architecture is described in more depth than most. The vendor publishes that it runs a multi model Panel of Judges combining foundation, fine tuned and proprietary models, that it continuously evaluates and selects the best model per task, and that its own model Luna Crescent is deployed inside its own AWS environment. It states the supply chain consequence explicitly and in the customer's terms: owning the model reduces reliance on external model providers, limits data exposure to additional subprocessors, and protects customers from third party availability, pricing and access disruption. Hosting is named as AWS. What is not published is which foundation models sit in the panel, from which providers, or which tasks route to them, and no subprocessor list or change notification commitment was located as of 29 Aug 2026. A buyer therefore knows the shape of the chain and its own model, but not the third party links in it.

Searched the vendor home page, product pages, newsroom and legal pages on 29 Aug 2026. No pricing page, no published rate, no stated unit of charge and no published tier structure located. The only commercial entry point is a demo request, which is sales gated and earns no credit. Several independent third party pricing analyses state the same, and one reports a consumption based tier that was not located on the vendor site. Third party per seat estimates are not vendor published and do not move this axis. Note that the vendor does publish its general terms openly, which is transparency of terms rather than of price and is graded on the liability axis instead.

Checked the site navigation, the platform and solution pages, the customers page, the about section and the footer on 29 Aug 2026. No pricing page exists on the property, no rate is published, no unit of charge is stated and no tier structure appears. Every commercial path terminates in a demo request. No free trial or self serve entry point was located, and no third party pricing figure was located either.

Segment coverage is described with substance: large law firms, in house legal departments, and professional services including a published forensic investigations customer story, spanning more than 1,000 customers across 50 plus markets with multi jurisdiction and cross border work as a stated strength. Practice coverage spans review and diligence, research, drafting and investigations. Not located as of 29 Aug 2026: any statement of the boundaries, meaning which firm sizes or practice areas the product is not built for.

Who the product serves is documented precisely across two dimensions, each with its own published pages. Six industries: manufacturing, financial services, pharmaceutical, technology, insurance and chemical. Eight business functions: legal, compliance, executive, sales, procurement, finance, human resources and marketing. Both law firms and corporate legal departments are addressed, with a stated base of more than 700 organisations across more than 70 countries including all four Big Four consultancies and named enterprises. An academic programme is published as a separate segment. The practice boundary is clear from the structure and consistent throughout: this is contract work end to end, from generation through negotiation to post execution analysis and investigation, and nothing on the property claims litigation or research capability it does not have.