Legora vs Qanooni: how they compare in 2026
Each product puts AI inside the lawyer's working tools, and they divide on breadth. Legora sells an agentic operating system, aOS, to large firms, legal departments and the public sector. Its Agent plans and carries out multistep work, and Tabular Review turns a document set into a grid with a source behind each cell. Workflows and Skills encode a team's methods, and Portal delivers work to clients under the firm's brand. Word and Outlook add ins, an editor and a mobile app sit around it, and Legora holds ISO 42001 beside SOC 2 Type II and ISO 27001. Qanooni is narrower and built around the single matter. QMatters assembles each matter from its email and documents and lays more than 5,000 live legal authorities beside it, so QCounsel, QDraft and QRedline research, draft and review with the whole file in view. Legora fits a firm that runs large reviews and wants clients inside its workflows. Qanooni fits a UK or Gulf firm that wants each matter briefed, drafted and marked up in Word from its own precedents and cited law.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
Everything Legora sells is generative. The Agent plans and executes legal work across the platform's tools, Tabular Review extracts answers from each document into a grid, research answers questions across jurisdictions, and drafting runs in Word, Outlook and the built in editor. An orchestration layer handles tool routing, memory, model selection and guardrails beneath them. Without the models there is no product left to sell.
Every module is model work. QMatters reads the documents, emails and files on a matter and builds a graph of its parties, facts and timeline with no manual entry, then keeps it current as new material arrives. QCounsel turns a plain English request into a plan of steps and runs it across the whole file, producing chronologies, a two page brief from a 300 page bundle, party maps and tables of dates and obligations. QDraft writes agreements, notices and client emails in the firm's tone from its precedents. QRedline reviews counterparty paper against the firm's playbook in track changes. Retrieval from more than 5,000 legal authority sources sits under all four. The product keeps no conventional workflow layer of its own. Matter records, billing and documents stay in the firm's existing systems, such as Actionstep and Microsoft 365.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Each cell in Tabular Review expands to its reasoning and the source documents behind it, and Portal answers carry links back to the exact source. Legal research works several sources in parallel, ranks them by authority and checks each finding against primary law before the answer returns. The rebuilt research layer announced on 14 September 2026 runs on an ontology of the law that maps how authorities rank and relate, including amendments and temporal validity. Its AI native citator follows a standard set and audited by former publisher attorney editors. Legora says it has cataloged more than 50 ways AI fails at legal research without publishing the list. The layer is in limited beta, and no accuracy figure, evaluation framework or hallucination rate is published.
Answers are built by retrieval rather than from the model's memory. Qanooni pulls statutes, cases and regulations from more than 5,000 legal authority sources at the moment of the request, attaches a citation to each line, and a click opens the original. The sources sit in a legal data graph hosted in Azure that maps how laws amend one another, which cases interpret a provision and how earlier versions changed. Official databases feed it, among them the UK's legislation service, the EU's official law database, the UAE Ministry of Justice and the Saudi Bureau of Experts. Matter answers cite the document on the file they came from. Qanooni states that the product cannot invent case law, and no measured accuracy rate, test set or failure analysis is published beside that statement. The source count stood at 1,000 in October 2025 and is given as more than 5,000 today.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
The Agent proposes a plan before it acts, carries out the work across documents, data sources and tools, checks whether it met the goal, and delivers work product into the project workspace for the lawyer's review and approval. It can also act without being asked, watching email, documents and projects and starting work when something needs attention. Tabular Review adds Mark as Reviewed, Lock Cells and Review Mode for team review, and full audit trails record every tool call, file access and agent action. ISO 42001 covers the AI management system, with human oversight named as a principle. No threshold at which the Agent stops for a person, and no route after a wrong output, is described.
Lawyers stay in the loop at set points. QRedline proposes its markup as track changes in Word, so each edit is accepted or rejected by the lawyer, and QDraft returns a first draft rather than a sent document. QCounsel plans and runs multistep work end to end, then hands back the chronology, table or analysis with every point cited to the file or the law. Qanooni's position is that nothing goes to a client without a lawyer's sign off. In its UAE case study the product flags risk, and the lawyers verify compliance, interpret what the risk means and advise the client. On Actionstep, each draft, review and change is logged to the matter. Which QCounsel steps run without approval, the point at which the product stops and hands back, and what happens after a step goes wrong are not described.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Legora counts more than 1,800 teams in over 50 markets and 100,000 lawyers on the platform. Named customers include White & Case, Crowell, Accor, Dentons Europe, Trowers & Hamlins and Grant Thornton UK, whose forensic investigations team has a published story. The customers page reports that users see a 25 percent improvement in work quality, that experienced users save 80 percent of non billable hours weekly, and that firms bill $6.4 million more per 100 lawyers a year. None of those figures carries a date, sample or method. An in house study with the analyst Ari Kaplan drew on conversations with 30 customers in nine countries.
Inspired Thinking Group, a UK marketing and content technology company, piloted Qanooni with its in house commercial legal team, and the results were published in January 2026. Comparable review tasks were timed against the team's earlier baselines using its standard time keeping. Review time fell by 60%, and personal productivity rose 21%. The team expects 25 to 30% once SharePoint and OneDrive files connect, a projection rather than a measurement. Inspire Legal Group became the first UK firm to run Qanooni inside Actionstep, and partners or founders at Legal Circle, Lecote and Primecase are quoted by name. Qanooni puts its base at more than 150 law firms across 11 countries. A UAE case study with the firm unnamed describes more than 200 contracts reviewed in seven days instead of two weeks, and figures on the Actionstep page carry no unit or customer.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The general terms bar Legora from using a subscriber's confidential information to train or fine tune AI models and require the same of its subcontractors. The terms, the data processing agreement and the security measures annex are published in versions for the EU and the United States, and the annex covers least privilege access, personnel confidentiality, authorization controls and retention on customer instruction. Ethical walls and role based access are stated to keep confidential information from crossing matters or projects, on access control built on the Zanzibar authorization model, and engineers reach customer data only with the customer's written approval. Privilege and work product handling are not addressed.
Client documents are referenced through retrieval at the moment of use and are never used to train a model, Qanooni's or any provider's. Each firm's data is logically isolated from every other firm and reachable only by that firm, behind role based access, single sign on and audit logging. The firm owns its matter graph as intellectual property and can export or permanently delete it at any time. Document contents stay in Qanooni's own Azure environment, with no third party document repository added. These commitments are made on Qanooni's website and in its articles. The user agreement that governs the product is not published, and nothing addresses privilege, work product or what the model provider keeps.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Legora sells to lawyers, firms and in house teams and describes the product as working with lawyers rather than replacing them, with the Agent's output delivered for a lawyer's review and approval. No position on the advice line, no treatment of competence and supervision duties and no jurisdiction limit appears in the acceptable use policy, the general terms or the product pages.
Sold to law firms and in house legal teams, the product is framed two ways in its own material. The Actionstep page calls it the legal AI that does the practice of law, covering research, review and drafting. Elsewhere the line runs the other way. Lawyers verify compliance, interpret exposure and advise clients while the product flags risk, and nothing goes out without a lawyer's sign off. Articles on UK practice tie its use to the SRA duties of confidentiality, competence and supervision. The published terms cover the website only. The user agreement for the product is not public, so no advice disclaimer, user restriction or jurisdiction limit appears in writing.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Legora holds ISO 42001 for its AI management system, independently audited with ongoing surveillance, and publishes what the certification covers: how AI is designed, deployed, supervised and monitored, with human oversight and structured governance as the operating principles. No internal owner of AI governance is named, no results of testing on model behavior before release are published, and nothing covers uneven output across matter types, parties or populations.
Accuracy, auditability and alignment are the three principles Qanooni names for trust in legal AI, and grounding in cited law is presented as its main control on output. Client data is excluded from model training, and a change of model is designed to happen without moving a firm's data. No governance framework, release testing regime, accountable owner or analysis of how output varies across practice areas, jurisdictions or languages is published. Articles on UK regulation describe how the SRA, the ICO, the FCA and the CMA approach AI in law firms, and the Equality Act 2010 for algorithmic screening, as background for buyers rather than as Qanooni's own controls.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
The security measures annex sets least privilege and role based access, and centrally stored logs traceable to unique usernames, with security logs kept at least 12 months. It adds data integrity signing, background checks and confidentiality agreements for staff, and retention as the customer instructs. Subscriber environments are logically separated and full production backups run every four hours. The data processing agreement has Legora report a personal data breach within 36 hours and delete or return personal data at the subscriber's choice when it ends. The subprocessor list, last updated 6 July 2026, names each provider with its purpose, data and residency, and a new subprocessor comes with 30 days to object. Penetration tests cover the full platform twice a year.
Data is encrypted in transit and at rest on Microsoft Azure, with role based access, single sign on, multifactor authentication and audit logging across the platform. Each firm's data is logically isolated, and the firm can export or permanently delete its matter graph whenever it chooses. The privacy policy lists the service providers that may process personal data, each with its purpose, hosting region and transfer safeguard. They are Stripe for payments, HubSpot for CRM, PostHog for product analytics, Microsoft for productivity and documents hosted in the UAE, and Langfuse in Germany for LLM monitoring. Personal data is kept for a reasonable time with no fixed period, and no retention period is given for documents, prompts or outputs. No incident or breach notice practice is published.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
General terms and conditions are published openly in an EU version and a version for the United States. They carry numbered liability clauses, aggregate caps that apply across the subscriber and its affiliates, a separate cap of €100,000 on beta features, and a carve out the terms call an Enhanced Claim. No indemnity for third party claims arising from output, warranty on output or insurance position is stated.
The only published terms are the website terms effective 5 August 2025, under UAE law with the Dubai courts as forum. They provide the website as is, exclude Qanooni's liability for the website and its content, and have visitors indemnify Qanooni. Use of the product itself falls under a separate user agreement that is not published. Caps, indemnities, warranties and recourse for wrong output therefore cannot be read before signing.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Legora integrates with document management systems rather than replacing them. An iManage technology partnership works through iManage APIs, and SharePoint, Box, virtual data rooms and contract lifecycle systems feed documents in. Add ins bring the Agent and playbooks into Word and Outlook, EDGAR sits among the research sources, and MCP connectors and third party legal services feed the Agent's context. A plugin released on 17 September 2026 brings Legora's grounded answers into ChatGPT Enterprise. What each connection moves, in which direction and what an administrator configures is not documented.
Installed from Microsoft AppSource as a ribbon tab in Word, the product also works in Outlook and Teams, so drafting, review and research happen in the documents and email the firm already uses. The Actionstep integration goes deepest. When a lawyer starts drafting in Word or Outlook, Qanooni pulls the matter details, client information, deadlines and related documents from Actionstep. Finished work saves back to the matter with version control, audit logs and matter linking. It switches on inside an existing Actionstep with no data migration. A Docusign partnership announced in April 2026 connects drafting and review to signature and agreement management. Document management systems are supported without being named, and the SharePoint and OneDrive file connection was still described as coming in January 2026.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Legora runs separate arrangements for the EU, the United States and Asia Pacific. Its subprocessor list sets out hosting and AI model providers by region, Microsoft, AWS and Google among them, with EU customers' data held in the EU and EEA. Storage is tiered to data sensitivity, technical teams in the EU and the United States support local clients, and subscriber environments are logically separated. No customer selection of region inside a tier is described, and where processing happens is not separated from where data is stored.
Microsoft Azure hosts the platform as cloud software, with each firm's data logically isolated from other firms. Document contents stay in Qanooni's own Azure environment while the lawyer works in the firm's Microsoft 365 tenant. For UK firms Qanooni describes data held in Microsoft's UK and EU data centers. For UAE and wider GCC work it states that local data is stored and processed in Microsoft's UAE data centers to meet DIFC and ADGM rules. The privacy policy allows personal data to be stored in the United States and the UAE. No private cloud or on premises option, tier difference or separate processing location for the language model is described.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
ISO 27001:2022 with a yearly audit, SOC 2 Type II and ISO 42001 for the AI management system are all current. The trust center at security.legora.com carries a resources section and a data flow diagram, and the security whitepapers and security measures annex are published without a gate. Penetration tests run twice a year under an assume breach method. The certifying auditor is not named.
ISO/IEC 27001:2022 certification and a SOC 2 Type II attestation cover the operating environment for the platform, which runs on Azure infrastructure that carries its own certifications. The auditor, the report period and the controls in scope are not published. Security documentation is sent on request through the demo and contact route, and there is no trust center or self serve portal. Personal data falls under the DIFC Data Protection Law of 2020, with complaints going to the DIFC Commissioner of Data Protection, and the company states GDPR compliance.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The subprocessor list names Microsoft, AWS and Google for hosting, infrastructure and AI models and OpenAI for AI models, with DeepL for optional translation and Linkup Labs for web results, each with its residency. New subprocessors are announced by updating the list, with 30 days for the subscriber to object. An orchestration layer handles model selection across tasks. No model or model version is named, and nothing states which provider serves which feature.
The platform is model agnostic. The model underneath can be swapped without moving a firm's data, since the firm's precedents, voice and accumulated judgment live in its matter graph rather than in a trained model. Neither the model in production nor its provider is named. Hosting on Microsoft Azure is stated, and the privacy policy lists Langfuse, based in Germany, for LLM observability and monitoring. No commitment to tell customers when the model changes is published.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
No pricing page, rate, unit of charge or tier structure is published, and the commercial route is a demo request. The general terms are published openly, so contract terms can be read before a sales conversation even though price cannot.
No price, plan, unit of charge or contract term is published. Every route leads to a 30 minute demo, and the Actionstep page sends firms to a phone number or their Actionstep representative. An ROI calculator estimates the hours and value a team could recover from its own rates and weekly hours, in pounds, dollars, euros or dirhams, and asks for contact details before it shows the report. It says nothing about what Qanooni costs.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Legora serves large law firms, small and mid sized firms, in house legal departments, the public sector and professional services, with solution pages for M&A, litigation, banking, insurance, private equity and tax. Multi jurisdiction and cross border work are stated strengths, with research sources across Europe and federal and state law in the United States. No firm size or practice area is named as outside its scope.
Law firms are the main buyer, from boutiques to full service practices, with more than 150 using the product across 11 countries. In house teams such as Inspired Thinking Group's commercial legal team use it too. Jurisdictions are named. The legal data graph covers the UK, the EU, the UAE, Saudi Arabia, Qatar and other GCC states, with Arabic and English drafting for UAE contracts and checks against UAE Labour Law and DIFC and ADGM rules. Published work spans commercial contracts, M&A due diligence, employment contracts under UK law, conveyancing and litigation chronologies. The ROI calculator lists practice settings from corporate and litigation to family, immigration, criminal and private client work. Practice areas or jurisdictions the product does not support are not stated.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
Under the heading Feedback, Usage Data and no training, Legora's general terms bar it from using a subscriber's confidential information to train or fine tune AI models and bar its subcontractors from doing so. Legora may use usage data to develop and improve the services, and shares it outside the company only when aggregated and anonymized. The home page and security page repeat the commitment as zero AI training on customer data.
A firm's documents are referenced through retrieval when a lawyer asks and are never used to train a model, Qanooni's own or any provider's. The same commitment appears on its security, home and Actionstep pages, and the firm's matter graph stays its own intellectual property. Because the model sits outside the firm's data, a change of model leaves the firm's knowledge where it is. No customer agreement is published, so no matching contract term can be read.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Section 17 of the security measures annex, dated 31 January 2025, keeps personal data under whatever retention the subscriber instructs during the data processing agreement, and clause 11 of that agreement governs return or deletion after it ends. No default retention period or zero retention setting is published. Backups of the full production environment run every four hours, and each subscriber's environment stays logically separate.
A firm can export or permanently delete its matter graph and documents whenever it chooses, and work saved through Actionstep stays on the matter with its version history. Personal data is kept for a reasonable length of time with no period given, and Langfuse monitors LLM activity from Germany. No retention window is stated for prompts, outputs or the logs of model calls, and no zero retention setting is described.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Ethical walls and role based access control keep confidential information from crossing matters or projects, and full audit trails record every tool call, file access and agent action. Access control is built on the Zanzibar authorization model. How a wall is set up, and whether retrieval applies document management permissions per user at query time, is not described.
Each firm's matters, precedents and knowledge are logically isolated and reachable only by that firm, and nothing is pooled across firms. Inside the firm, role based access, single sign on and audit logging control who sees which matter, and the matter graph organizes every document and email by the matter it belongs to. How matter permissions are set, and whether they follow the access rules in the firm's document management system or in Actionstep, is not described.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Legora's general terms let a party disclose confidential information when law or an order of an authority, regulator or court compels it. The compelled party gives the other notice of the proceeding where the law allows and cooperates in seeking confidential treatment. The data processing agreement adds notice of any communication with a data protection authority about Legora's processing. No transparency report is published.
Under its privacy policy, Qanooni may have to share information with public authorities or law enforcement, for example under a court order, after satisfying itself that a lawful basis exists and documenting the decision. It makes no commitment to tell the firm about a request or to resist one, and no transparency report is published. Product terms that might add a notice duty are not public.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Legora names the sources behind its research. Federal law and all 50 states in the United States are hosted on Legora, beside SEC EDGAR. European sources include France's Cour de cassation, Germany's federal statutes, Sweden's court portal, Lovdata, Retsinformation, Finland's legal database and Portugal's official gazette, and content partnerships bring in publishers. The Qura acquisition adds a Swedish database of case law, legislation and regulation. No license basis or update lag is stated for any source.
The legal data graph connects statutes, case law, regulations, circulars and gazettes for the UK, the EU, the UAE, Saudi Arabia, Qatar and other jurisdictions. Named sources include the UK's legislation service, the EU's official law database, the UAE Ministry of Justice and the Saudi Bureau of Experts, and connections are described as permissioned, timestamped and refreshed routinely. The rights basis for each source and a fixed update schedule are not given.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Legora is building its own AI native citator on an ontology of the law, announced on 14 September 2026. The ontology captures the hierarchy of authority, how sources relate and temporal validity, so an amended rule or an overruled case is recognized as such, and former publisher attorney editors set and audit the standard. The technology comes from the Qura and Wexler acquisitions. The citator is in limited beta, with general availability planned for the fourth quarter of 2026, and no coverage figure or error rate is published.
Each line of an answer cites the statute, case or regulation it rests on, and the legal data graph maps how laws amend one another, which cases interpret a provision and how versions have changed over time. Sources are read live at the time of the request, so a statute appears in its current form rather than as a training snapshot. No flag on a cited case that has been overruled, reversed or distinguished is described.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
The Agent checks whether it met the goal and loops back to adjust, and research ranks sources by authority before answering. No explicit no answer path, abstention behavior or confidence value shown to the user is described.
Answers come only from retrieved sources. Where no authority supports a point, the product says so and leaves the claim out rather than inventing support, and Qanooni invites firms to test this in a demo on their own matters. No published evaluation shows how often it declines to answer.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming Legora or Leya. Legora's research checks findings against primary law, and its Tabular Review links every answer to the document it came from.
The AI Hallucination Cases database maintained by Damien Charlotin, which records court decisions worldwide that address hallucinated AI content and the tool involved where known, has no entry naming Qanooni. Every answer the product gives carries a citation that opens the source behind it.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Legora publishes material on its own AI governance and ISO 42001 certification, and none of it engages ABA Formal Opinion 512, a state bar opinion or national bar guidance on lawyers' use of AI.
Articles for UK firms tie AI use to UK GDPR and to the SRA's duties on confidentiality, competence and supervision. They also summarize how the SRA, the Law Society of England and Wales and the Law Society of Scotland approach AI, and a pilot plan template for UK firms sets out governance controls and roles. UAE material covers DIFC and ADGM data rules. No specific ethics opinion or practice note is discussed, and no mapping of the product to guidance in either market is published.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Legora sells to law firms and in house teams, and its customers page reports 80 percent of non billable hours saved weekly by experienced users and $6.4 million in additional billing per 100 lawyers a year. The small and mid sized firm page pitches more matters handled without more headcount. No record of AI assisted work by matter for fee purposes, and no billing or client disclosure guidance, is offered.
On Actionstep, every draft, review and change Qanooni makes is logged back to the matter with the cited authorities behind it, a per matter record of AI assisted work. Elsewhere the platform keeps an audit log. Qanooni claims drafting 50% faster, six to eight hours saved per lawyer each week and fewer non billable hours, and offers an ROI calculator. It publishes no guidance on billing or disclosing AI assisted work to clients.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Legora publishes its subprocessor list by region, last updated 6 July 2026, naming Microsoft, AWS, Google and OpenAI as AI model and hosting providers with their purpose, data categories and residency, and offers email updates. Its general terms, data processing agreement, security measures annex and acceptable use policy are published without a gate. No client facing consent or notice pack is offered, and trust center documents come through a request.
The privacy policy lists five service providers with their purpose, hosting region and transfer safeguard. They are Stripe, HubSpot, PostHog, Microsoft and Langfuse, and copies of the standard contractual clauses are offered by email. No model provider is named. Security documentation and certification detail are sent on request, and no client facing disclosure pack is published.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Full audit trails record every tool call, file access and agent action, Tabular Review cells link to their source documents, and Portal answers cite the exact source. No export for each document records the model used and the human verification, and no court disclosure template is offered.
Every line of output cites its source, and on Actionstep each draft, review and change is logged to the matter with the authorities behind it. QRedline's edits arrive as track changes, so the document itself shows what the product proposed and what the lawyer accepted. The platform keeps audit logs of access. No export ties a document to the model used, the sources retrieved and the lawyer who verified it, and no court disclosure template is published.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Commercial Transparency
Which one fits
Choose Legora if
- You review data rooms or large document sets. Tabular Review sets out documents as rows and prompts as columns, and each cell opens to its reasoning and source.
- You want clients working inside your methods. Portal gives them a branded workspace where they run the firm's workflows and get cited answers from the files you share.
- You need your own encryption keys or AI governance certification. Legora offers customer managed keys, builds access control on the Zanzibar authorization system and holds ISO 42001.
Choose Qanooni if
- You want every task to start from the whole matter. QMatters reads the matter's email and documents into one current record of parties, facts and timeline.
- You draft and negotiate in Word against firm standards. QDraft writes in the firm's tone from its precedents, and QRedline marks up counterparty paper in track changes with fallback positions from the playbook.
- You practice in the UK or the Gulf. The legal data graph draws on official sources such as the UAE Ministry of Justice and the Saudi Bureau of Experts, and firms on Actionstep can switch Qanooni on inside their existing system.
In summary
Legora
Legora, founded in Stockholm, sells aOS, an agentic operating system for law firms, in house teams and the public sector. The Agent plans and runs multistep work, Tabular Review structures large document sets with a source behind every cell, and Portal shares work with clients. Word and Outlook add ins, Lists, Monitors and a new Intake module extend it. According to the AI Legal Index, Legora will not use customer data to train or fine tune any AI model. It offers customer managed encryption keys and holds ISO 42001, ISO 27001 and SOC 2 Type II.
Qanooni
Qanooni AI Ltd, registered in Dubai's DIFC free zone, sells Qanooni to law firms in the UK and the Gulf. The product lives in Word, Outlook and Teams. Its QMatters layer turns a matter's email and documents into a graph of parties, facts and dates beside live law, and QRedline marks up counterparty paper against the firm's playbook in track changes. According to the AI Legal Index, Qanooni cites a source on every line of output, isolates each firm's data, and quotes prices only after a demo.
Questions buyers ask
Legora or Qanooni for a mid sized UK firm?
Legora sells to mid sized firms as well as large ones, and its breadth suits firms that run big reviews or deliver work to clients through Portal. Qanooni is aimed at firms that want AI in Word and Outlook organized by matter, and its Actionstep integration lets firms on that system switch it on with no migration. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
How do Tabular Review and QCounsel differ?
Tabular Review is a grid for reviewing many documents against the same questions, with each cell tied to its source. QCounsel takes a plain English request about one matter and runs the steps itself, returning a chronology, summary, party map or table drawn from the whole file. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
How does each handle client data and model training?
Legora will not use customer data to train or fine tune any AI model, lets customers set retention periods and offers customer managed encryption keys. Qanooni never uses client content to train a model, isolates each firm's data, and lets a firm export or permanently delete its matter graph at any time. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
What security certifications do Legora and Qanooni hold?
Legora holds ISO 42001 for AI governance alongside ISO 27001 and SOC 2 Type II, and states GDPR and HIPAA compliance. Qanooni holds ISO/IEC 27001:2022 and a SOC 2 Type II attestation for its platform environment, with security documentation sent on request. From the AI Legal Index, based on each vendor's own published materials as of October 13, 2026. No vendor pays for placement.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Legora was founded in Stockholm in 2023 as Leya and took its current name in 2025. Qanooni AI Ltd raised a $2M pre seed round in June 2025, and third party research profiles list Legora among Qanooni's competitors. Neither vendor reviewed this page.