netLex vs Sirion: how they compare in 2026

netLex combines a contract lifecycle platform with AI for clause drafting, review, extraction and questions about agreements. Its OpenAI integration lets users simplify, translate or revise clauses with prepared or custom prompts. Review Agent compares incoming contracts with the customer's playbook, while Creation Agent turns an existing document into questionnaire fields and variables. Management Agent extracts dates, parties, amounts and obligations for portfolio monitoring. Those capabilities sit within a wider system of templates, approvals, negotiation, signatures and storage that can operate without generation. The June 2026 agent announcement also describes an early access program; creating templates from a description alone was still forthcoming.

Sirion's contract lifecycle platform came before its AI, and the company has traded since 2012. The product is organized as Store, Create and Manage, covering repository, drafting, approval, negotiation, obligation tracking and performance management. Without the agents and agentOS, a working enterprise CLM remains, and Gartner classifies it as one. The models drive the capability Sirion now sells on top of it. Agents are described as extracting and normalizing contracts, assembling first drafts from a playbook, proposing redlines on the other side's paper and monitoring obligations. Customers can also build and deploy their own agents in agentOS.

Review Agent compares clauses with a company playbook and explains departures from its standards. netLex also describes questions about contracts and attachments, including inconsistencies between the main agreement and a commercial appendix. These are useful sources of context, but the product materials do not demonstrate an openable citation for each answer or a method for validating cited legal authorities. No reproducible accuracy test, sample size or breakdown of missed risks is published. The terms explicitly warn that AI responses may be inaccurate, incomplete or unsuitable. A reviewer therefore has to compare proposed changes with the agreement and applicable law before relying on them.

AskSirion answers questions within one agreement or across the enterprise contract corpus, combining relevant clauses with related obligations, service levels, and counterparty records. Each answer links back to its underlying source, and the interface explains how it interpreted the user's request. Follow-up questions preserve context, while summaries, financial calculations, and date calculations draw on the same contract information. This establishes a traceable retrieval workflow for the customer's agreements. An externally reproducible accuracy evaluation, error breakdown, or legal citator is not specified. References to an agreement establish the source of a commercial term, rather than verifying that an external legal authority remains current.

Administrators must enable the OpenAI functionality before users can access it, and customer policies govern its use. A reviewer can accept, edit or reject suggested wording, with the final contract remaining under human control. netLex describes additional approval steps for important negotiation changes and a Review Agent configured against the customer's clause rules and acceptable limits. Its July 2026 explanation distinguishes automated actions from human decisions in the history. The precise uncertainty level that stops an agent, mandatory escalation triggers and the procedure for undoing an erroneous downstream action are not published. The terms require users to assess AI results before adopting them.

AskSirion interprets a request and orchestrates agents for drafting, redlining, extraction, obligation tracking, and invoice reconciliation. Custom agent setup uses ordinary language to define the task, accessible data, connected systems, and when to escalate to the user. Agents can be tested with real scenarios and refined after launch. Recommendations include explanations and source links that allow review against the underlying contract. This gives administrators an escalation mechanism beyond a general promise of human control. Default stop conditions, the approval interface for consequential actions, and recovery after an incorrect action remain unspecified. The launch sequence permits an agent to go live before subsequent scenario testing.

Gupy provides a named example of deployment with operational figures. In netLex's September 2026 account, Gupy simplified its commercial amendment language, introduced defined approval responsibilities and connected Salesforce before measuring changes in the first months. Average amendment completion fell from 38 to 25 days, while legal response time fell from 1.58 to 0.31 day. Amendments signed without customer changes increased from 16% to 60%. The account attributes the improvements to a combined process and integration project, not an isolated AI intervention. Exact observation dates, document counts and an independently reviewed measurement protocol are absent, limiting comparisons with other organizations.

Three customer representatives speak on the record with their roles and employers. Edzard Janssen is Chief Procurement Officer at RBI. Reinhard Plaza-Bartsch is Head of Digital Supply Chain and Operations at Vodafone. Angella Dikmic is Manager of IT Vendor Management at GTAA. All three quotes are qualitative, and all three people work in procurement or vendor management rather than legal. The five percentage claims name no customer and read as product capabilities, so named customers and published figures are never paired. About 25 enterprise logos appear, including Citi, GE, Coca-Cola, Chevron, PayPal, Bayer, Rolls-Royce, Aramco, Yamaha, DP World and Zalando. Customers are in more than 70 countries, with more than $450 billion of contract value under management. Sirion also publishes a case study library.

The privacy policy states that inputs supplied to netLex AI will not train the model, and the product description says drafting and review data are not retained by the AI service. Access controls use roles, corporate authentication and customer permissions. netLex describes agents as unable to reach information beyond the current user's access, with a separate customer environment. Contract storage nevertheless has its own lifecycle: deleted user records can leave name and email history, and backups remain for five years. The public terms do not directly promise preservation of attorney privilege or explain how model provider access affects work product protection.

Vendor library articles say customer data stays within the customer environment and is not used to train external language models. Clause 4.2 of the SaaS Terms, version 6, modified 26 August 2026, says otherwise. It reserves a right for Sirion to have its automated systems review and process Customer Data to generally inform machine learning capabilities in the services. None of the published agreements offers an opt out, and the agreement, not the library articles, is what binds. The rest of the confidentiality framework is published and can be read before signing. The data processing addendum stores and processes all customer data in a Sirion application instance specific to the customer. It sets Article 32 technical and organizational measures, with AES-256 at rest and TLS 1.2 in transit. It imposes need to know and least privilege access with automatic logout, requires deletion within 30 days of termination, and commits to notifying the customer of a confirmed security incident within 72 hours. Section 5 of the SaaS Terms adds mutual confidentiality, with a duty to give prior notice of any authority or court demand so the other party can object. The published agreements and trust center do not address privilege or work product.

netLex is aimed at legal departments and the business teams working with them on company agreements. Its terms require users to assess the relevance, accuracy and suitability of AI results before adopting them for any purpose. They also state that AI cannot replace necessary human, legal, technical or professional analysis. The drafting interface supports this division by leaving acceptance or rejection of suggestions with the user. However, jurisdictional limits on automated legal opinions and a detailed account of lawyers' competence or supervision duties are not supplied. Corporate staff can initiate contracts and requests without being lawyers, making the configured approval route significant.

The platform is sold to procurement, sales and finance teams as well as in house legal, all working on the same contracts. The three customer referees Sirion features are procurement and vendor management leaders, not lawyers. The home page, the trust center index with its AI ethics, compliance and security sections, and the terms and policies index say nothing on where tooling ends and legal advice begins. There is no statement that Sirion does not give legal advice, no professional responsibility or ethics page, no named bar or ethics guidance, including ABA Formal Opinion 512, and no jurisdiction limits.

netLex publishes principles for AI use in contracts: company playbooks, access permissions, traceable decisions and final human approval. It describes logs that distinguish automated decisions from human actions and presents these controls as part of its own design. That establishes an AI governance position, but not a full account of how the vendor tests its models. No named owner for model risk, release evaluation protocol, bias assessment across languages or results across contract types are supplied. The Information Security and Compliance Committee oversees security and privacy; its existence alone does not show accountability for uneven legal output or model behavior.

The trust center has a section titled Artificial Intelligence Ethics and Governance, last modified 16 December 2025, and its whole content is three sentences. They say Sirion has set up an AI Governance Program called S-AIGP, which monitors and ensures compliance with the EU AI Act 2024/1689 and other AI regulations as they emerge. Readers are told to contact their Sirion Account Executive for more. Sirion publishes nothing on who owns model behavior, what is tested before release, how the program works, or bias and uneven output.

The privacy policy separates user data, customer agreements and AI inputs, and names the purposes for processing them. Users' personal data are deleted when their account or the customer contract ends, with limited identity history retained and backups kept for five years. Customers direct deletion of third party personal data in agreements. At termination, extraction is through REST APIs returning base64 content, so the customer needs its own conversion and storage capability. Published safeguards include encryption, role permissions, annual external penetration testing and an incident response team. A deadline for notifying customers of a breach and precise AI service retention exceptions are not supplied.

The data processing addendum, version 3, modified 2 July 2026, covers retention, access, subprocessors, incidents and encryption. Appendix B sets the retention period by the controller's contractual direction. Clause 8.1 requires deletion or return of all Customer Personal Data, including copies, within 30 days of termination. Any retention the law requires is limited to that purpose and stays under the agreement's protections, and the SaaS Terms add automatic deletion after 30 days as a backstop. Access runs on a need to know and least privilege basis, with automatic logout on inactivity. Subprocessors are named in a list published at its own URL. Sirion gives notice and an objection right for any addition or replacement, imposes equivalent terms on each, and is liable for their breaches. Clause 4.3 commits Sirion to notify the customer within 72 hours of establishing material impact from a confirmed Security Incident, and Appendix B says 48 to 72 hours, with updates until resolved. The definition expressly excludes unsuccessful attempts such as failed logins and denial of service attempts. Encryption is AES-256 at rest and TLS 1.2 in transit.

The August 2025 terms place responsibility for AI results on the user and disclaim accuracy, completeness and suitability. They expressly exclude netLex's liability for decisions, actions and omissions arising from use of AI functionality. Separate provisions also disclaim losses from errors in generated agreements and third party service failures. If netLex is nevertheless held liable, the stated ceiling is the amount the customer paid for the platform during the preceding twelve months. No published AI output indemnity, professional liability insurance commitment or compensation mechanism for a harmful clause is provided. A negotiated software license may contain additional provisions unavailable in these public user terms.

Sirion publishes its SaaS terms and a separate end user agreement, so both can be read before signing. Clause 7.1 commits Sirion to indemnify and defend the customer against third party claims that use of the services infringes intellectual property. Clause 7.2 sets four exclusions, namely combination with materials Sirion did not provide, unapproved changes, unauthorized use, and use inconsistent with the documentation. Clause 7.3 gives the remedies of securing the right to continue, replacing or modifying the services, or terminating with a pro rata refund of prepaid fees, as Sirion's sole and exclusive liability. Clause 7.4 has the customer indemnify Sirion over customer data. Clause 8.1 caps each party's total liability, across the whole term, at the fees paid for the subscription in the twelve months before the first event giving rise to a claim. Clause 8.2 excludes lost profits, lost or damaged data and consequential loss, and under clause 8.3 the cap does not apply to fees owed, breach of confidentiality or the indemnities. Clause 6.2 warrants that the services perform materially in line with the documentation, with a pro rata refund if Sirion cannot correct a nonconformity reported within ten days. Separate Sirion AI Services terms extend the intellectual property indemnity to the AI features, but exclude claims that come from the customer failing to review or validate output. Section 5.1 of those terms disclaims any warranty that output is accurate or free from hallucinations. No insurance position is published.

Salesforce and HubSpot integrations map CRM properties to variables in netLex contract templates. Customer identity, commercial amounts, payment terms, dates and opportunity stage can feed the agreement; the configured stage triggers generation. Contract creation history and the information used remain visible inside the CRM. Legal teams prepare the approved templates and the customer configures the field mapping and trigger. Gupy describes using this process for commercial amendments. netLex also supplies Slack notifications, directory authentication, signature connections and a REST API, with netLex Connect supporting custom input and output flows. Its announced MCP interface still lacks a separate public release confirmation.

Nine named connectors are documented, each with its direction of travel, in the Non-Native Integrations article in Sirion University, last updated 24 February 2026. Four SAP Ariba accelerators cover procurement, bids, awards and contract workspaces. An executed contract request in Sirion creates a purchase requisition in Ariba, and the resulting purchase order is written back. Ariba sourcing events and RFPs become Contract Draft Requests on set triggers, one per bidding supplier with line items mapped, and supplier redlines move into Sirion for legal review. Awarded RFx events create a draft request with awarded line items synced. Contracts finalized in Sirion copy into Ariba Contract Workspaces with metadata, documents, line items and status. Three more connectors cover supplier master data from Ariba, SAP S/4HANA Business Partners on scheduled transfers, and Oracle ERP with logging, error handling and sync status. The Microsoft Dynamics connector runs both ways in auto or manual mode. The article describes configuration through triggers, modes and scheduling rather than as a full guide, and the wider Sirion University catalog needs a login. Sirion's public pages do not document the Word add in or the Salesforce connector to this depth. No document management connector such as iManage or NetDocuments appears on them.

netLex runs on AWS and lets customers choose storage in the United States, Europe or South America. The privacy policy identifies the United States, Ireland and Brazil as contractual locations for storage or processing. It separately permits subcontracting and sharing with providers in other countries, including the United States. A selected repository region therefore does not establish that every AI request stays there. Backups are geographically distributed, without a separate public map of their locations. The native AI integration is with OpenAI, but its processing geography is not tied to each customer region. No customer hosted deployment option is described.

Sirion's application is SaaS hosted by a cloud provider, according to the data processing addendum, and all customer data is stored and processed in a Sirion application instance specific to that customer. That isolation commitment sits in a contract rather than in marketing. Four underlying providers appear in the trust center, namely AWS, Azure, Oracle and IBM, which suggests customer choice without offering it as an option. Sirion's published documents make no residency commitment and give no region list or jurisdiction option. Nothing separates where processing happens from where data is stored. A Sirion library article describes the platform's multitenant scalability, which sits awkwardly beside the addendum's customer specific instance, and nothing published reconciles the two.

netLex states that it holds ISO 27001:2022 certification and obtains SOC 2 Type I and Type II reports through recurring audits. The reports are available by request under a nondisclosure agreement. The public security description also specifies annual external penetration testing, static code analysis, component vulnerability analysis and separation of development, test and production environments. Production data are excluded from development and testing. These are more specific assurances than an infrastructure badge alone. However, the public text does not identify the SOC auditor, report observation period or exceptions. AWS's separate certifications should not be treated as independent coverage of every netLex AI function.

Appendix B of the data processing addendum names ISO 27001 as a held certification and describes the review process around it. Under clause 7.1, unless agreed otherwise, Sirion will give a copy of its latest security attestation report on the customer's written request, no more than once a year. Clause 7.2 adds a customer audit right, with scope, timing and controls agreed in advance and a reasonable fee. Appendix B also says Sirion reviews its cloud providers' SOC 1, SOC 2 and ISO 27001 reports as part of a shared responsibility model. That is oversight of the infrastructure rather than an attestation over the application. The report route is open to existing customers, so a prospective customer cannot get the report before signing. The addendum names no auditor, coverage period or scope statement for the ISO certificate. Sirion's trust center states ISO 27001:2022 certification. Its SOC 1 Type II and SOC 2 Type II sections explain what those reports cover, and its security page attributes SOC 1 and SOC 2 to the cloud providers Sirion runs on.

OpenAI is identified as the provider behind netLex's native AI drafting and revision features. The privacy policy explains that the integration uses the OpenAI API, and the published supplier list also names OpenAI API and ChatGPT alongside AWS and other service providers. It does not identify a current model version for each agent or specify how those agents route tasks among models. Nor does it map OpenAI processing to the customer's selected storage region. Customers receive notice of privacy policy changes, but a distinct commitment to advance notice of model substitutions is absent. Newer agent features therefore need more detailed supply chain terms.

A combination of more than ten large language models and more than 1,200 proprietary small language models powers the contract agents. A routing framework selects a model according to the task, while company content, policies, and risk preferences can refine agent behavior. The same architecture supports extraction, drafting, redlines, obligations, and invoice reconciliation through agentOS. Provider names, model families and versions, and processing locations for individual inference tasks are not identified. There is also no model change notification commitment attached to this architecture description. The disclosure explains how different model types are combined without identifying every external model a customer inherits.

The monthly subscription normally depends on the number of users and their access profiles. It includes implementation and automation of an agreed number of documents; additional document automation is priced according to project complexity. Native integrations, including electronic signature connections, are included, while integrations needing special configuration receive a separate project price. This explains the charging structure without publishing a per user rate, minimum contract value or an AI consumption allowance. A quote must distinguish ordinary platform access from any agent entitlement or usage charge. Public materials do not settle renewal increases, termination charges or the total cost of a large migration.

No pricing is published at any level, including the unit of charge. Sirion's site has no pricing page, no tier structure, no unit per seat, per contract or per agent, no volume banding and no statement of what implementation adds. Every call to action is a demo request. No published figure lets a prospective customer estimate cost before a sales process, even though Sirion publishes its SaaS terms, end user agreement and data processing addendum in full.

netLex serves company legal, sales, procurement, finance and operations teams through contracts, powers of attorney, legal requests and related corporate records. Named customers include Ambev, Blip and Isaac, with Gupy illustrating commercial amendments generated from a CRM. Its templates and playbooks can cover supply agreements, employment contracts, confidentiality agreements and services contracts. The interface is offered in eleven languages and service is available in Portuguese, English and Spanish. Use in more than sixty countries describes geographic adoption, not verified legal coverage in each jurisdiction. The product does not publish an exhaustive set of supported laws, exclusions or a separate law firm matter management offering.

Eight industries have their own pages. Financial services is split into procurement and into capital markets and lending. Insurance has a separate solution for triaging underwriting submissions. The others are automotive, IT services, healthcare, pharmaceuticals and life sciences, telecom, and oil and gas. Five departments have their own pages, covering in house legal, legal operations, procurement, sales and finance. Customers are in more than 70 countries, and the site is in English, German and French. Sirion does not say where the product stops. It excludes no contract or matter types, does not address law firms, government or public sector use, and describes coverage by industry and department rather than area of law.