A

Actionstep

The models drive a growing set of capabilities on a practice management platform that would still run without them. Actionstep has spent twenty years as the operational system for midsize firms, running matters, documents, billing, trust accounting and reporting, and its AI layer, Actionstep Intelligence, is built on that record. Today it covers passive time capture through the Trace add on, which tracks work across Outlook, Word, PDFs, Teams and the browser, maps it to the right matter and billing code and drafts a bill ready narrative; business intelligence that answers plain language questions about profitability, realization and billing trends; and matter summaries and alerts.

Agents that carry out workflow tasks within limits administrators set are announced as coming soon. The company frames its AI around running the firm rather than practicing law, and it says every AI feature is opt in, which is the vendor stating plainly that the product stands without the models. That places it one band below the top.

Actionstep's AI does not cite law. The question is whether a time entry lands on the right matter with an accurate description and whether an answer about firm profitability is right, since both feed invoices clients read and decisions partners make. The company describes grounding in its own data rather than accuracy. Business intelligence answers are described as sourced and contextual, drawn from the firm's matters and billing records, and Trace entries are mapped to matter and billing codes and presented for review, editing and posting.

The Trace page reports 25 to 50 more hours billed and 100 hours of manual entry saved per lawyer each year, and write downs and appeals under 3 percent, noting that results vary by location. None of those measures accuracy, and no method is given. Section 6.6 of the Terms provides the service as is and disclaims any warranty that content is accurate or complete.

There is a written commitment that the firm sets the limits and reviews the work, and the controls for autonomous agents are still to come. The AI page says administrators set the boundaries, lawyers review before anything is acted on, every AI feature is opt in, and the firm can see and audit what the AI did. Trace follows that pattern. It drafts each time entry for a person to review, edit and post, can be turned off at any time from the system tray, and lets users exclude internal email or specific activity.

Agents that carry out workflow tasks within boundaries set by administrators are described as coming soon, with every action logged along with who approved it and what followed. Not yet published is how those boundaries are set, which actions will need approval each time, and what happens when an agent acts wrongly.

Scale claims and product figures stand in for named deployments. Actionstep says it supports nearly 5,000 law firms worldwide and publishes a 2026 report on UK midsize law firm priorities based on its own survey. The Trace page reports 25 to 50 extra hours billed and 100 hours of manual entry saved per lawyer each year, with write downs and appeals under 3 percent, noting that results vary by location. None of those figures is tied to a named firm, a period or a method.

The navigation links to a customer stories page, but on 29 September 2026 that address returned a not found error, so the usual place for named deployments was empty.

Substantive commitments on training and professional duties exist, with the AI commitment in policy rather than contract. The AI page says Actionstep does not use a firm's data to train AI models and that client information, matter history and billing records are not shared with outside AI providers in a way that exposes them beyond the firm. The Terms do not mention AI or training, so that promise sits on a web page, not in the agreement.

The Terms do give real confidentiality protection to one group. The addendum for firms regulated by the Solicitors Regulation Authority recognizes that data may include confidential client information subject to professional duties and commits to protect it accordingly. It also waives any lien over the data, keeps storage in the UK or EU and requires 28 days' notice before hosting changes. For all customers, access is governed by user roles and permissions, and section 8.5 allows deletion 30 days after termination, with a backup available on request within 20 days. Privilege is not named.

A clear line on advice written for a professional user, short of guidance on the lawyer's duties when using the AI. Section 6.5 of the Terms says the firm alone decides whether the service suits its regulatory and compliance requirements and that Actionstep does not provide legal, compliance, regulatory, accounting or tax advice, and sections 6.3 and 6.4 say anti money laundering and trust accounting obligations stay with the firm, which indemnifies Actionstep for breaches of them.

The SRA addendum goes further for regulated firms in England and Wales, acknowledging the regulator's powers and agreeing to cooperate with it. On the AI itself, the company frames Actionstep Intelligence as serving the business and operations of the firm rather than practicing law, and its AI page says lawyers review before anything is acted on. Nothing connects the AI features to a lawyer's duties of competence, supervision or billing accuracy, which matters for a tool that drafts the narratives on client invoices, and no bar or regulator guidance on AI is cited.

Governance is described as a design principle with controls for the firm, and the vendor's own program is not published. The AI page says governance is built in from the start, not added later. It lists the controls a firm has: opt in features, boundaries set by administrators, lawyer review before action, and a full view of what the AI did. It also describes an internal AI center of excellence that guides customers and shapes the roadmap.

Those are real commitments that put the firm in charge of its own use. They do not describe how Actionstep governs its models: who is accountable for their behavior, what is tested before a new model is connected, and whether time capture or profitability insights perform unevenly across practice areas, offices or fee earners. That matters because the company calls itself model agnostic and expects to switch to better models as they appear. No responsible AI framework, ISO 42001 or equivalent is cited.

Published terms and a security page cover most of the ground, short of an AI provider list and an incident commitment. Section 8.5 of the Terms allows Actionstep to delete all copies of a firm's data 30 days after termination and gives the firm a backup if it asks within 20 days; the New Zealand addendum keeps data seven years for tax purposes. Sections 9.2 and 9.4 host the service on Amazon Web Services in a region the firm elects.

The security page lists multi factor authentication, single sign on, role based permissions and encryption of data in transit, and the company announced in February 2026 that it had completed a SOC 2 Type 2 examination. The SRA addendum commits, for those firms, to act only on the firm's instructions, maintain technical and organizational measures, vet staff with access and audit its measures at least annually. What is not published is a list of subprocessors that includes the AI providers behind Actionstep Intelligence, or any commitment on how quickly a firm would be told of a breach.

The allocation of loss is published in full, and it puts nearly all of it on the firm. Section 7 of the Terms excludes all liability for loss or damage resulting directly or indirectly from use of or reliance on the service. It limits any claim for Actionstep's negligence or breach to the access fees paid in the previous 12 months, and makes termination the firm's only remedy if it is dissatisfied. Section 6.6 provides the service as is and as available with every warranty disclaimed.

Sections 6.3 and 6.4 exclude liability for regulatory penalties from anti money laundering or trust accounting failures, with the firm indemnifying Actionstep. Nothing in the Terms addresses the AI features, so a time entry billed to the wrong matter or a misleading profitability insight falls under the same general exclusion. Only the SRA addendum adds a duty of reasonable care and skill and an assurance against intellectual property infringement, for regulated firms in England and Wales.

Actionstep positions itself as the hub other tools connect to, and some of those connections are described in depth. The integrations page says the platform integrates with most tools midsize firms use and lists an Outlook add in for Office 365 as its primary integration, with Trace capturing work across Outlook, Word, Excel, PDFs and Teams; the Privacy Policy describes the Google integration's scope in detail, from saving documents to Drive and email records from Gmail to creating and updating calendar appointments; and the company names QuickBooks Online, Xero and DocuSign elsewhere, and offers a public API under published developer terms.

On the AI side, it features Lexidesk, an AI intake service, as a partner integration. The AI page makes the strategic point directly: AI tools need a trusted data layer, and other tools must integrate with Actionstep rather than the reverse. The integrations directory itself notes that listings are not monitored for quality by Actionstep and that firms should assess partner software themselves, and what each connection moves in which direction is documented only for Google.

Regions and processing location are published and chosen by the firm; the tenancy model and the AI processing location are not. Section 9.2 of the Terms hosts the service on Amazon Web Services regions determined by the firm's data sovereignty requirements, and section 9.4 lets the firm elect any AWS region Actionstep supports, commits to keep its data on servers in that region, and notes candidly that because users connect from anywhere, some data may travel outside it.

For firms regulated by the Solicitors Regulation Authority, the addendum fixes storage in the United Kingdom or European Union, requires lawful transfer mechanisms for anything leaving those regions and 28 days' notice before the arrangements change. Actionstep contracts through entities in the United States, United Kingdom, Australia and New Zealand, which is why regional hosting matters to its buyers. What is not stated is whether firms share infrastructure, which regions are supported, and where the third party AI providers behind Actionstep Intelligence process a firm's data, which may not be the region the firm elected.

A real, dated attestation is announced, without a report a buyer can reach unprompted. On 18 February 2026 Actionstep announced it had completed a SOC 2 Type 2 examination, explaining that the AICPA standard tests both the design of controls and how they operate over a review period, and the announcement is linked from every page footer. The security page adds AWS hosting, multifactor authentication, single sign on including federated sign on, role based permissions and encryption of data in transit.

The SRA addendum commits to an annual audit of security measures for regulated firms in England and Wales. The auditor, review period and systems in scope are not published, including whether Actionstep Intelligence and Trace are covered, and there is no trust center or route for requesting the report.

Outside AI providers are acknowledged and deliberately left unnamed. The AI page says Actionstep is model agnostic, so firms can move to better models as they appear without rebuilding. It also says client information, matter history and billing records are not shared with third party AI providers in a way that exposes them beyond the firm. Both statements confirm outside providers are involved, and neither names one.

No model, provider, inference location or version appears on the AI, Trace or security pages, in the Terms or in the Actionstep Intelligence webinar recap, and nothing commits the company to tell firms before it changes models. Being model agnostic is a reasonable engineering choice, but it makes notice of changes more important, because the model reading a firm's email and documents to capture time may change without the firm knowing.

The unit and structure of charging are published by region, without figures. The pricing page lets a firm choose its region, US, UK, Australia, New Zealand or Canada, and describes each product as priced per user plus implementation fees. Practice Management includes time capture, billing and core accounting, and Legal Accounting, available only in North America, is sold alone or added to practice management. Every tier ends in a request pricing button.

The support center adds that a base access fee covers up to three licenses, with per user charges beyond that. The Terms set billing at the start of each subscription period, prorated additions, no refunds for prepaid periods and no credit for unused licenses. The pricing page does not say whether Actionstep Intelligence and Trace cost extra. A firm can see how it will be charged, including a separate implementation fee, but not what it will pay.

Segments, practices and jurisdictions are described in substance, and the Terms say plainly what the product does not do. Actionstep is built for midsize law firms, with pages for fourteen practice areas, from mixed practice, bankruptcy and banking to personal injury, immigration, residential real estate and tax. It also has pages for six roles, from managing partners and firm administrators to IT and accounting managers.

It contracts through entities in the US, UK, Australia and New Zealand, prices by region including Canada, and publishes privacy policies and terms addenda for each jurisdiction, including the SRA addendum for regulated firms in England and Wales. Its legal accounting product is available only in North America. The Terms state that the service is not designed or warranted to meet anti money laundering requirements or any jurisdiction's trust accounting rules, which firms must confirm themselves.

Nothing says how well the AI features serve each practice area or region, for example whether Trace works across languages.