Oneflow vs Spellbook: how they compare in 2026
Oneflow is a fit for legal and business teams managing the agreement process around CRM data, collaborative editing and signature. Spellbook is a fit for lawyers drafting and reviewing in Word, with Associate handling related files and selected repository material. Spellbook's iManage connection expressly applies existing permissions and ethical walls; Oneflow publishes workspace access controls without the same matter wall inheritance description. Their training permissions also differ. Spellbook prohibits provider training but permits customer specific personalization and limited monitoring, whereas Oneflow bans model training on customer data and separately excludes generative AI confidentiality. For a firm choosing how client material enters the workflow, AI Legal Index identifies permission inheritance and contractual scope as separate questions. Spellbook's cited public legal sources extend beyond contract passages; Oneflow's review concentrates on the customer's agreement and playbook.
At a glance
All 15 axes, side by side
The same grid applied to every vendor in the index, graded from public sources. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
AI supports several substantial contract tasks within Oneflow's wider platform. Write with AI drafts, edits and translates text inside an agreement; AI Extract imports participants, dates and duration into editable metadata. AI Review compares terms with a workspace playbook, and AI Insights aggregates the resulting risks across the portfolio. The premium package adds custom rules, dashboard widgets and a report for negotiation follow up. Electronic signatures, editable HTML agreements, permissions, approvals and renewal reminders continue to work without these models. Customers can disable AI, and several review capabilities remain in beta. AI therefore changes how users analyze contracts without replacing the underlying contract system.
The models are the product. Review, Draft, Ask, Compare and the Associate agent are all generative capabilities delivered through a Word add in that exists to carry them. The company pivoted its whole business to generative AI in 2022, rebranding from Rally to Spellbook. Remove the models and there is no product, only an empty add in.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Review findings connect to highlighted passages in the agreement, with controls for moving between them. Each finding carries the relevant playbook concept, configured feedback and example clause text. A separate view identifies required clauses that the review did not find, while portfolio charts open the corresponding contract list. This lets the reviewer compare a proposed concern with the actual wording and the organization's rule. Oneflow warns that generated text can misstate facts, numbers and law and recommends human correction. No reproducible accuracy study, error rate or jurisdiction specific evaluation accompanies these features. The contract highlighting supports source verification, not validation of legal authority.
Ask can use selected iManage files and return citations to the team's own contracts. The legal data connection retrieves material from named public sources such as CanLII, CourtListener, Cornell Law, EUR Lex and regional legal information institutes, with links to the underlying authority. Those sources can inform questions, drafting and review inside the same workflow. Their currency follows the source operator's updates. A reproducible accuracy evaluation for the current product, an automatic subsequent treatment check and a stated abstention threshold are not specified. A citation makes an answer inspectable; it does not establish that a quotation or legal proposition has been verified by the reviewing lawyer.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
Administrators enable AI Review for a workspace and configure its playbook, including which clauses matter, which findings count as risks or issues, and what feedback appears. Role permissions separately control access to individual reviews and the Insights dashboard. Sent contracts receive continuing analysis; draft contracts require a manual review action. A person can inspect highlighted text, edit the playbook and use example wording when revising an agreement. The AI appendix advises human review before relying on output. No confidence cutoff, mandatory lawyer approval after an AI finding, or correction route for an already approved mistake is specified. Risk colors classify findings rather than stop execution.
Review proposes changes in Word for the lawyer to inspect and approve, either individually or in a group. Playbooks encode the team's instructions, while Associate takes on work across several files with user oversight. Proposed edits can carry the reviewer's identity when accepted, and citation links let the reviewer inspect supporting material. The terms place responsibility for reliance and verification with the customer. The existing suite therefore has recognizable human review surfaces, but no universal threshold is stated at which Associate must stop or escalate an unsupported conclusion. The separately announced Autonomous Contract Management offering remains in early access.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Puzzel's Sales Operations Manager, Anette Johnsen, describes generating offers and contracts from Salesforce opportunities with items from related CPQ quotes. She identifies a concrete benefit of the HTML format: participants revise one agreement instead of uploading successive files before signature. Other named users include Systembolaget's Head of Indirect Sourcing, Tor Myhrman, and Hedin Bil's HR Business Partner, Elin Skoglund, who describe handling agreements and maintaining oversight. These accounts establish operational use across sales, procurement and HR. They do not isolate AI review performance or supply a measured error reduction, evaluation period and sample for Oneflow's current AI packages.
Spellbook has named customer accounts involving Dropbox, Panasonic, KMSC Law, Alturas Capital Partners and Elevare Law. Panasonic's account concerns saving three weeks while building an RFP process, while other testimonials describe drafting capacity and keeping work inside the legal team. The current pricing page states use by more than 5,000 legal teams and includes those stories alongside separate firm and in house offerings. These examples establish identifiable use rather than only a logo wall. A consistent dated measurement protocol, comparison baseline and workload definition do not accompany the range of savings claims, so the figures are specific customer accounts rather than a reproducible general result.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
The AI appendix expressly prohibits Oneflow from training any AI model on customer data and takes precedence over conflicting general terms for AI features. Ordinary service confidentiality continues while information remains confidential, with restrictions on compelled disclosure. There is a consequential exception: the generative AI section excludes Oneflow's contractual confidentiality obligations along with liability, indemnities and service levels. Review, Insights and Extract have a separate processing section tied to the DPA. Workspace permissions and optional provider controls support access management, but attorney client privilege and work product receive no specific undertaking. The contract therefore requires attention to the exact AI functionality being enabled.
Spellbook's agreement expressly protects privileged information and work product and requires confidentiality for staff and service providers handling customer content. Its iManage integration preserves existing file permissions and ethical walls. Third party models cannot train on customer content and operate under zero retention commitments. Spellbook itself may use deidentified content for customer specific personalization and retain inputs and outputs temporarily for quality assurance, while the terms restrict those uses and access. These permissions are narrower than unrestricted cross customer training, but they are not an across the board ban on learning from client content. Application history also has no single stated in use retention deadline.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point. Where the advice line is not the duty a product raises, the axis is read through the nearest professional duty it does raise: judicial conduct rules and the reviewing duty for products sold only to courts, and the duty to bill for time actually spent for products that draft time entries.
Oneflow's AI appendix says output is not legal advice, legal conclusions, recommendations about legal rights or an application of law to a customer's circumstances. It advises human review because generated content can misstate law as well as facts. A separate UK article maps solicitor responsibilities to SRA standards, confidentiality, client communication and supervision, and describes practical review and pilot controls. North American terms also prohibit treating the platform as a substitute for an attorney. The product nevertheless serves sales, HR and other users without legal qualifications. No comprehensive jurisdiction by jurisdiction set of product restrictions or lawyer competence program is supplied.
Spellbook's terms identify output as information rather than formal legal advice and place verification and appropriate lawyer review with the customer. The product is directed to law firms and legal departments, with review controls inside Word and oversight of Associate's work across files. The agreement also warns that non English use can produce unsatisfactory results. That is a concrete language limitation, but not a tested jurisdictional coverage matrix or a map of which regulated services the software can provide. Human acceptance of a redline remains part of contract work, and an answer from a cited public source is not a substitute for checking its legal application.
AI Governance and Bias Disclosure
Published governance over model behavior: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
Oneflow promotes human accountability and warns against automation bias in its guidance for UK legal teams. It recommends evaluating missed issues, overrides and review quality rather than relying only on speed, and says its AI performs best in English and Swedish. These are useful limits and principles for customers designing a pilot. The public material does not identify an accountable AI governance owner, publish a model release evaluation, or report bias and performance differences across languages, contract types or populations. General ISO security controls and a list of security policies concern operational protection; they do not describe a separate AI testing and governance program.
Spellbook's terms describe internal AI risk and prohibited use policies, staff education and regular reassessment of ethical and legal requirements. Its security material also cites a CMS Law opinion classifying the product under the EU AI Act and identifying applicable controls. These are concrete governance arrangements beyond a general promise to act responsibly. The product supports verification through citations and user approval of edits, but those controls are separate from evaluating a model before release. A named internal owner, a reproducible release test set and disclosed results about uneven behavior across populations or matter types are not specified in the available framework.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Contract data is encrypted with AES 256 at rest and TLS 1.2 in transit. Customers configure permissions and retention policies; administrators can disable optional providers or AI features. Global DPA terms require breach notification without undue delay, while the North American DPA specifies 48 hours. Daily database snapshots last seven days, and system and authentication logs last 90 days. The DPA permits limited residual backups after deletion without fixing that period. Generative AI history can follow provider terms, while the product page promises removal of temporary review and import data. That leaves no single, specific retention schedule for every prompt and output.
OpenAI and Anthropic process Spellbook requests under zero retention and no training commitments. Spellbook's own terms permit quality assurance copies of inputs and outputs for up to 90 days, restricted to authorized staff, and self service abuse monitoring for up to 30 days unless an investigation or law requires longer. Microsoft identity integration lets organizations enforce their authentication policies, and iManage access preserves source permissions. The agreement covers confidentiality, security incidents and deletion or return of customer material, while the processor register identifies downstream services. The ordinary lifetime of all application history is not stated as a single fixed period.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
Ordinary global service terms include an intellectual property defense obligation, a material performance warranty and a general cap based on 12 months of fees. Those protections do not carry through unchanged to AI. The appendix supplies AI output as is, disclaims warranties and excludes all liability and indemnification undertakings for generative AI functionality, together with confidentiality obligations and agreed service levels. It also permits specified AI suspensions or termination without reimbursing fees. North American terms contain the same generative AI exclusion. A wrong clause, inaccurate summary or reliance on generated advice has no specific affirmative AI remedy in these published terms.
Spellbook gives an indemnity for specified intellectual property claims against its software and provides service warranties, while disclaiming the accuracy of generated output and responsibility for customer reliance on it. The general limit is twelve months of fees, with exceptions including confidentiality, security, data incidents and indemnification duties. The agreement includes mutual protection for specified data incident claims and gross misconduct. Beta Features have separate warranty exclusions and a CAD 10,000 cap. These are concrete protections for platform and data risks, but they do not provide an accuracy warranty compensating a client when an accepted clause or legal assertion is wrong.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
The Salesforce integration creates interactive contracts from opportunities and transfers contact, company and opportunity data into them. Its configurable sync sends data from Salesforce objects into Oneflow and returns contract values to Salesforce. Product tables can reflect price books or CPQ quotes, while workflows map contract stages back to pipeline stages. Engagement events and status changes appear in the Salesforce timeline, and returned contract data supports dashboards. Oneflow identifies separate setup guidance for older and newer integration versions and compatibility with Professional edition upward. HubSpot, Dynamics 365 and other CRM connections complement this workflow; Salesforce and Dynamics can require premium integration charges.
The iManage connection starts from Add from iManage in Ask or an Associate Project and authenticates the user's account once. The same connection then works in Word and Associate. Users select files through the attachment control or project file list; selected content becomes available as chat context or project references without a manual download. Answers cite the imported contracts, and precedents can guide review of incoming paper. Existing iManage permissions and ethical walls govern file access. The connection describes movement from iManage into Spellbook's working context; it does not promise automatic return of revised files to the source repository.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Production infrastructure uses AWS availability zones in Ireland, with document replication and backups in Sweden. Oneflow's AI FAQ broadly describes data as remaining in the EU, and Insights Premium is described as running within Oneflow's own EU infrastructure. The published subprocessor table gives a more varied picture: optional Legly review operates in Germany, optional OpenAI extraction in the United States, and Postmark email processing also in the United States. Administrators can disable optional services. The public descriptions do not fully reconcile these routes or map every AI function to a processing region. No on premises deployment is offered in the published package descriptions.
Spellbook uses AWS as its primary cloud provider and states that customer content is stored and processed in Canada and the United States. Third party model requests are handled under zero retention agreements with OpenAI and Anthropic, while Spellbook itself has separate retention rights for quality and abuse monitoring. The Word add in and Associate connect to shared cloud services, including optional sources such as iManage. The public description identifies storage and processing countries but does not offer a per tier residency selector or a dedicated customer deployment. A source system's location therefore does not confine every later processing step to that same location.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
A public certificate issued by Qvalify covers Oneflow AB's digital solution for contract automation under ISO 9001:2015, ISO 14001:2015 and ISO 27001:2022. It was issued on June 28, 2024 and remains valid through June 30, 2027, identifying the Stockholm organization and its registration number. A June 2026 statement of applicability lists the security controls and their implementation status. The security center separately identifies SOC 1 Type 1 and SOC 2 Type 1 reports issued by Grant Thornton, available under NDA. Those reports concern control design; neither is identified as a Type II examination of operating effectiveness over a stated period.
Spellbook states that it is SOC 2 Type II compliant and provides a trust portal for reports, processor information and compliance resources. Its security program uses encryption, Microsoft identity controls and agreements governing model providers. The public security explanation also describes HIPAA support through business associate agreements where appropriate and a legal opinion on EU AI Act classification. These are different assurances with different scopes. The accessible product explanation does not establish the current SOC audit period, auditor and full service scope. The named SOC standard therefore supports a specific certification claim without treating every resource or regulatory statement as an equivalent independent security audit.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The subprocessor list identifies Legly AB for contract review in Germany and OpenAI for extraction in the United States, alongside AWS infrastructure in Ireland and Sweden. Both AI suppliers are optional and controlled through account settings. The AI appendix directs customers to their Data Management page for the current generative model suppliers and their terms. It does not publish model versions or a complete function to model map. DPA provisions require reasonable advance notice of subprocessor changes to the customer's designated email address and allow a 14 day objection. That process concerns suppliers, without promising notice of every underlying model change.
Spellbook names OpenAI and Anthropic as language model suppliers and uses zero retention agreements that keep request and response content in memory for processing rather than persistent storage at those providers. AWS is the primary cloud provider, and storage and processing are described in Canada and the United States. The trust portal lists processors and records updates when suppliers change. Exact production model versions and a routing map for each feature are not specified. A public processor update history is not an explicit commitment to notify every customer whenever a model version or deployment location changes within the same supplier.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
Business starts at $292 a month, billed annually, including five users; Enterprise has ten users and a custom quote. Business includes writing, extraction and summary features. Standard AI Review and Insights have conflicting public treatment: the pricing page marks paid beta additions, while September help guidance says they are included in Enterprise during beta. Insights Premium is explicitly a paid addition for Business and Enterprise. SMS, identity verification, premium integrations and enhanced support can cost more. A 14 day trial needs no card. Implementation has no published amount, and global annual renewals can increase by the greater of 5 percent or Swedish CPI.
Spellbook prices the suite according to the number of team members on a license. Law firm and in house packages both include the Word add in and Associate, training and online support, with dedicated support for teams above ten. The in house offering includes a playbook build service. A seven day trial is available, with extended trials possible for larger organizations. Subscription amounts remain custom rather than a public per user rate. The terms describe annual renewal by default and included maintenance and support, but the price of a particular deployment and any separately agreed services remains part of its order.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Legal, procurement, sales, finance and HR teams can create and manage agreements in Oneflow. Legal users configure review rules and approve terms; business teams use reusable templates and CRM data for offers, sales agreements and employment documents. Named customers span telecoms, retail, recruitment and public sector purchasing. UK guidance also addresses solicitors using AI for commercial contract review, bringing professional duties into the intended audience. AI is optimized for English and Swedish, with variable results in other languages. The product does not supply a jurisdiction specific research corpus, and its coverage statements do not define supported litigation work or every category of legal agreement.
Spellbook separates law firm and in house packages and organizes its principal tools around transactional drafting, review, negotiation and questions about agreements. Associate extends work across several files, and iManage access allows firms to use existing contract precedents. Industry material covers energy, healthcare, finance, technology, manufacturing and consumer businesses. The legal data connection adds government and court sources across many regions, but that source breadth does not establish tested competence in every practice. The terms warn about non English results, while Autonomous Contract Management remains in early access. A complete account of unsupported jurisdictions or specialized legal tasks is not specified.
The 12 legal signals, side by side
Recorded rather than graded. These are the questions a practitioner has to answer before a tool touches a client matter, and the answers are taken from public material only.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
The AI appendix forbids Oneflow from using customer data to train any AI models and overrides conflicting general terms for AI issues. Inputs and attributable outputs fall within the customer data definition. The general service license permits improvement and anonymized analysis, and AI feedback may improve accuracy, but those clauses do not remove the express training ban. The product FAQ also says underlying models do not train on customer data.
Separate provider processing, retained history and the generative AI confidentiality exclusion remain relevant to handling client material.
The terms prohibit third party models from retaining or training on customer content. Spellbook itself may process deidentified customer material to improve that customer's features and calibrate personalized systems, without using that personalization for other customers. It can also evaluate prompt and system improvements through limited quality monitoring. These own service improvement permissions are distinct from the provider prohibition and do not require a separate opt in in the standard agreement.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
Oneflow permits customers to set retention policies for stored contracts, and its AI page says temporary import, review and Insights data is removed after use. Generative AI has a different contractual provision: input questions and output responses may remain as history under the model supplier's current terms. No uniform period covers that history or every provider copy. Daily database snapshots last seven days, system logs last 90 days, and residual backups after termination have no precise DPA deadline. Contract deletion therefore cannot be treated as an immediate purge of all AI processing records.
Model providers handle request and response content in memory under zero retention agreements. Spellbook may keep quality assurance inputs and outputs for up to 90 days, and self service abuse monitoring data for up to 30 days, with investigation and legal exceptions. Those are specific secondary uses rather than a stated ordinary lifetime for all application history. Deletion and return provisions do not establish a configurable zero history setting.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
Workspace roles control access to contracts, and Oneflow provides distinct permissions for AI Review and the Insights dashboard. Administrators enable review for selected workspaces and can disable AI features or optional suppliers. These controls can support departmental separation and limit who sees review results. The descriptions do not specify how retrieval enforces every contract permission within a workspace, how restrictions propagate to generated summaries, or how a law firm's matter wall follows an AI request. Permission controls alone do not establish a complete ethical wall mechanism for confidential client matters.
The iManage integration applies existing iManage permissions and ethical walls to file access inside Spellbook. A user authenticates the source account once, then selects permitted files for Ask in Word, Ask in Associate or an Associate Project. Selected material becomes context for answers and review. This protection is specifically described for the iManage connection; it does not establish the same permission inheritance for every optional storage connection.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Global confidentiality terms require reasonable prior notice when disclosure is legally compelled, unless notice is prohibited, and reasonable assistance at the customer's expense in seeking protection. That gives the customer an opportunity to contest or narrow a request involving ordinary confidential service data. The AI appendix expressly removes contractual confidentiality obligations for generative AI functionality, so the same protection should not be assumed across every AI route.
No transparency report accompanies the commitment. North American and global agreements need to be matched to the contracting entity and enabled services.
Spellbook's terms require prompt notice of a legal or government demand for customer data and reasonable cooperation with efforts to obtain a protective order or contest disclosure. The confidentiality provisions also address compelled disclosure and protection of privileged material. These contractual steps give the customer an opportunity to respond to a demand. A published report enumerating government requests and their outcomes is not specified alongside that commitment.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
Oneflow's review and portfolio analysis work with the customer's agreements and configured playbook concepts. Example clauses come from the organization's rule setup, and drafting can use selected text as input. No catalog of legislation, reported decisions or licensed legal commentary is supplied for these features. Naming a model provider does not identify the legal sources in its training data or their licensing terms.
The UK educational articles link professional guidance, but those links do not constitute a legal research corpus inside the product.
The legal data connection names public sources including CanLII, Cornell Law, CourtListener, EUR Lex, BAILII and national government registers. Spellbook retrieves material directly from each source of record and follows its update cadence. The same workflow can use the customer's own contracts and iManage precedents. The named source list makes jurisdiction coverage inspectable, but does not state an individual license or public domain basis for every external collection or its separate market benchmark data.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
Highlighted review passages let a user inspect contract language, not whether a judicial decision remains authoritative. Oneflow has no published citator connection, treatment history service or automated check of legislation's current status. Teams maintain their own playbooks, including preferred and fallback clauses, so changing a rule after a legal development remains an organizational responsibility. The appendix warns that AI can generate incorrect law and recommends human review. A portfolio risk chart or missing clause flag does not establish that the underlying legal proposition remains valid.
Spellbook's legal data feature returns citations to public case law, statutes and registers, with currency tied to the operator of each source. Ask, Draft and Review can use that authority within the contract workflow. The feature does not describe a licensed citator or a method for checking subsequent judicial treatment of a case. A current link to the underlying decision is therefore separate from a signal that its legal proposition remains reliable.
Refusal and Uncertainty Behavior
What does the product do when the answer is not in the corpus?
The AI Review interface separates findings from a missing clauses view. That view identifies playbook concepts absent from the agreement, giving the reviewer an explicit negative result instead of merely omitting a match. Red and yellow labels distinguish issues from risks; they are not numerical confidence estimates. Oneflow warns that generated facts and law can be wrong, but does not publish a general abstention rule for drafting or summaries. Missing clause handling is described for review, without promising that every unsupported question will be refused.
Source citations and selected precedent files provide context for Spellbook's answers and proposed redlines. A lawyer can inspect that material and accept or reject suggested changes. The product does not describe an automatic no answer response, an exposed confidence threshold or a required escalation when available material cannot support a conclusion. A contractual warning about unreliable output assigns verification to the user rather than defining an abstention mechanism.
Fabricated Citation Record
Does a public court record exist addressing fabricated or hallucinated legal citations in output from this product?
Damien Charlotin's AI Hallucination Cases database contained no entry naming Oneflow as of October 16, 2026. The result covers the database's reported court incidents, not every private use of the product or every inaccurate contract response. Oneflow itself discusses court examples involving generic AI tools in educational material; those examples do not identify Oneflow as the tool involved. Contract drafting and risk analysis can still produce incorrect law, which the AI appendix expressly warns about. The absence of a named incident provides no accuracy guarantee.
Youssian v Village of Kings Point, 2026 NY Slip Op 26150, Supreme Court of New York, Nassau County, September 9, 2026, addresses counsel's fabricated quotations and misrepresented holdings. The opinion recounts counsel accepting Spellbook AI changes without repeating a citation check. It sanctions counsel $5,000, awards $10,000 in fees and strikes both petitions. The findings concern the lawyer's verification and response to the errors; the product attribution appears in counsel's explanation.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Oneflow's UK contract review guidance maps SRA standards and conduct duties to human supervision, confidentiality, client transparency and practical controls. It also discusses insurance, data protection and the legal team's responsibility for final judgment. This is a jurisdiction specific mapping with suggested review steps, rather than a generic statement that lawyers remain responsible. It is vendor guidance, not regulator approval or an independent finding of compliance. The mapping does not establish equivalent coverage for every jurisdiction in which Oneflow sells its platform.
Spellbook's educational material addresses competence, candor and checking AI output in general terms, and the company has a relationship with the Canadian Bar Association. Its terms also require appropriate legal review and distinguish output from formal advice. Those positions concern professional responsibilities, but the available account does not map the suite to a named ethics opinion or a set of jurisdiction specific bar requirements. A partnership alone does not supply that mapping.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
The vendor's UK AI review material addresses solicitors as well as internal legal departments and promotes faster review with retained professional judgment. Its product pages also describe reducing routine contract work and administrative effort. No accompanying procedure explains how a firm records AI time, adjusts a client invoice, discloses savings or passes through Oneflow charges. Subscription pricing is the buyer's software cost rather than a client billing policy.
Because the audience includes lawyers serving clients, the time savings claims cannot be treated solely as an organization's internal operating expense.
Spellbook presents the law firm suite as a way to improve profitability and the in house suite as a way to retain more work internally. Customer stories describe time savings, including Panasonic's RFP process. The product's per user subscription is separate from a lawyer's charges to clients. A matter level invoice record of AI assisted time or instructions for disclosing those savings on a client's bill are not described in the current pricing offer.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
Oneflow supplies a public DPA, global and North American service terms, an AI appendix and a subprocessor table with functions and processing locations. Optional AI suppliers include Legly and OpenAI, and administrators can control optional services. A public ISO certificate and statement of applicability support security diligence; SOC reports require an NDA. These materials help counsel explain data handling to a client.
They do not form a dedicated client AI disclosure package, and the generative AI confidentiality exclusion and conflicting regional descriptions require specific attention in any outside counsel approval process.
Spellbook identifies OpenAI and Anthropic, provides a processor register and explains provider retention and training restrictions. Its security resources address SOC 2 Type II, HIPAA support and an EU AI Act opinion, while the agreement covers privileged information and legal demand notice. Those materials support a firm's client review. They do not form a single client consent pack, and the firm's account must distinguish provider restrictions from Spellbook's own personalization and monitoring permissions.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
AI Insights supports an export of portfolio analysis, and reviewers can inspect the contract passages associated with a playbook finding. Insights Premium adds an action report for internal discussion and negotiation. Enterprise also includes an account audit log, while signing workflows maintain transaction records. The published export instructions do not establish a complete record of model identity, prompt, output and human edits for each AI action.
These are useful contract administration records, but no court disclosure template or complete model provenance export is described for a later filing.
Word review retains proposed tracked edits, and answers based on contracts or public legal data include source citations. Those features preserve portions of the review process and allow a lawyer to check supporting material. An export combining exact model version, retrieved sources and human verification for each generated passage is not described. The available editing and citation records are therefore partial support for an account of AI use rather than a complete court certification package.
The questions both sides leave open
Derived from the records above rather than written, so it cannot favor either vendor. Take these into both conversations and ask each side the same question.
- Good Law Verification
Which one fits
Choose Oneflow if
- The project requires sales intake, business approvals and electronic signature.
- CRM values and contract stages should remain synchronized.
- Review should follow workspace playbooks within a shared web agreement.
Choose Spellbook if
- Lawyers want AI drafting and tracked review directly in Word.
- iManage ethical walls must govern access to selected precedent files.
- Cited public legal sources are needed alongside contract text.
In summary
Oneflow
Oneflow provides a shared contracting workflow from CRM creation to signature and renewal. AI review highlights relevant agreement language and missing playbook concepts, with administrator controlled workspace access.
Spellbook
Spellbook adds drafting, tracked review and legal questions within Word, plus Associate projects across files. Its iManage integration preserves source permissions and ethical walls, and legal research names several public authority sources.
Questions buyers ask
Does Oneflow inherit iManage ethical walls like Spellbook?
Oneflow describes its own workspace permissions and AI access controls, without the same published iManage inheritance mechanism. Spellbook expressly describes preserving iManage permissions and ethical walls for that connection. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Does Spellbook provide the same contract lifecycle platform?
Its core suite serves drafting, review and legal questions in Word and Associate. Autonomous Contract Management remains an early access offering, so it should not be assumed to replace Oneflow's existing creation and signing workflow. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
Is there a reported court incident involving Spellbook output?
Youssian v Village of Kings Point, 2026 NY Slip Op 26150, Nassau County Supreme Court, September 9, 2026, concerns counsel's fabricated quotations and verification failures. Counsel attributed accepted changes to Spellbook; the finding concerns filer conduct. From the AI Legal Index, based on each vendor's own published materials as of October 16, 2026. No vendor pays for placement.
What is the strongest practical distinction for a law firm?
For a firm moving precedent material into AI review, AI Legal Index highlights Spellbook's stated iManage permission inheritance. Oneflow instead supports a business agreement workflow with its own access controls, and its generative AI confidentiality exclusion warrants separate consideration.
Neither vendor paid for inclusion, placement or a grade, and neither reviewed this page before it published. Everything on it comes from public material on the dates shown. How the index grades.
Spellbook's reported court incident concerns counsel's conduct, and its autonomous management offering remains early access.