Actionstep
Actionstep is a cloud practice management platform for mid-sized law firms covering matter management, document automation and management, email and calendaring, client intake, conflict checks and CRM, a client portal, time capture, billing, invoicing, payments, trust accounting and full legal accounting, with workflow automation across fourteen practice areas. Its AI layer, Actionstep Intelligence, launched in August 2026 alongside Trace, a passive time-capture tool from the January 2026 acquisition of Traced; the vendor states that every AI feature is opt-in, that a firm can see and audit what the AI has done, that firm data is not used to train AI models, and that client, matter and billing data are not shared with third-party AI providers in a way that exposes them beyond the firm. The company is Actionstep Limited of New Zealand, contracting through subsidiaries in the United States, the United Kingdom, Australia and New Zealand, backed by Serent Capital since 2020 and serving more than 5,000 firms. Its published terms let a customer elect any supported Amazon Web Services region for its data, delete data thirty days after termination, and for firms regulated by the Solicitors Regulation Authority waive any lien on data, keep data in the United Kingdom or European Union and give twenty-eight days' notice of any change. Actionstep completed a SOC 2 Type 2 examination in early 2026, and integrations include Microsoft 365, Gmail and Google Drive, QuickBooks Online, Xero and DocuSign.
Capability grades
All 15 axes, graded from public sources on the date shown. Hover a grade to see what the letter means on that axis.
AI Centrality
How much of the product is actually AI. Whether the machine learning is the mechanism the buyer is paying for or a feature layered onto conventional software, and whether the vendor is specific about which is which.
The models are the engine of a core capability layered on a product that would still function without them. Actionstep Intelligence and Trace passive time capture sit on a practice management platform that has run matters, documents, billing and trust accounting for years; the vendor's own AI page makes every AI feature opt-in, which is the vendor stating the product stands without them. Home page, AI page and terms read 6 September 2026.
Citation Accuracy and Hallucination Disclosure
Whether the vendor publishes measured accuracy on citations and assertions, grounds output to primary sources, and says plainly what its system does when it does not know. Legal has a documented public record of fabricated citations reaching filed briefs, so an untested claim of accuracy is not evidence.
Accuracy is disclaimed without measurement and the primary-authority limbs do not apply. Terms section 6.6 disclaims any warranty of the accuracy, reliability or completeness of content or data, and the AI features capture time and surface matter information rather than citing law; no accuracy figure, test set or evaluation for Trace or Actionstep Intelligence is published on the surfaces read. The Actionstep Intelligence product page was not opened. Terms and AI page read 6 September 2026.
Autonomy and Oversight Model
What the system decides on its own, what a lawyer must approve, and whether the vendor documents where the review point sits. A tool that drafts under review and a tool that files without one are different products and different risks.
A written commitment that the firm controls what the AI does, with a visible audit surface, short of the full control structure. The AI page states that every AI feature is opt-in, that the firm chooses what AI does inside the firm, sees what it has done and can audit it; Trace captures time passively for a person to review before billing. What is not published is any threshold at which the system acts alone or a stated route back after a wrong capture beyond the firm's own review; the Actionstep Intelligence page was not opened. AI page and home page read 6 September 2026.
Operational and Outcome Evidence
Named, dated evidence that the product works in production at real firms or legal departments. Case studies with figures and identified customers count. Unattributed testimonials and launch announcements do not.
Scale claims stand in for named deployments on the surfaces read. The vendor states more than 5,000 firms and publishes a midsize law firm priorities report as a survey finding, not a deployment outcome; the customer stories page exists in the navigation and was not opened, and is the rebuttal route. Home page and navigation read 6 September 2026.
Privilege and Confidentiality Posture
How client confidences are handled: attorney client privilege and work product treatment, segregation of one client matter from another, whether client data trains any model, and what the vendor commits to in writing rather than in marketing.
Substantive published commitments on confidentiality, training use and professional duties, short of the full picture. No training: the AI page states that firm data is not used to train AI models and that client, matter and billing data are not shared with third-party AI providers in a way that exposes them beyond the firm, and the terms are silent on training with a data licence confined to providing the service. Segregation at the level a firm requires: roles and permissions per user under terms section 2 and the security page. Professional duties in writing: the addendum for firms regulated by the Solicitors Regulation Authority recognises that data may include client confidential information subject to professional duties, commits to protect it consistently with those duties, waives any lien on data and gives twenty-eight days' notice of any change to hosting arrangements, though for SRA-regulated firms only. Retention: deletion thirty days after termination under section 8.5. Short of A because the training commitment is policy rather than contract and privilege as such is not named. Terms, AI page and security page read 6 September 2026.
UPL and Professional Responsibility Posture
Whether the vendor is clear that it supplies a tool rather than legal advice, who its audience is, and how it addresses unauthorized practice of law, competence and supervision duties, and jurisdiction limits. ABA Formal Opinion 512 is the reference point.
A real position on advice versus tooling, framed for a professional user, short of a competence dimension. Terms section 6.2 states that use of the service does not constitute legal, accounting, financial or other professional advice, section 6.5 that the firm must have the professional expertise to assess suitability and may not rely on Actionstep for compliance decisions, and sections 6.3 and 6.4 that AML and trust accounting obligations stay with the firm; the AI page frames AI as opt-in and auditable. Jurisdiction is addressed by contracting entity and governing law. No bar guidance on AI use is named. Terms and AI page read 6 September 2026.
AI Governance and Bias Disclosure
Published governance over model behaviour: who owns it inside the vendor, what is tested before release, and what is disclosed about disparate output across matter types, parties, or populations.
User-facing controls without a governance framework, testing regime or accountable owner. The AI page's commitments, opt-in features, visibility of AI actions and auditability, are controls a firm exercises rather than a description of how Actionstep governs its own models; no responsible AI framework, ISO 42001 or equivalent, pre-release testing or statement about uneven output is published on the surfaces read. AI page and terms read 6 September 2026.
AI Safety and Data Stewardship
Retention, deletion, access control, and what happens to prompts and documents after they are processed. Whether the vendor states its subprocessors and its incident practice, or leaves the buyer to assume.
Substantive published policy covering most of the ground. Retention and deletion: terms section 8.5 permits deletion thirty days after termination with a backup available on request within twenty days, and the New Zealand addendum retains data seven years for tax purposes. Access control: multi-factor authentication, single sign-on and role-based permissions on the security page. Hosting: Amazon Web Services in a customer-elected region under section 9.2 and 9.4. Sub-processors: the privacy policy names service providers such as Intercom and the Google integration scope, and section 5.4 addresses third-party application access; no consolidated list with AI providers was located. Incident practice: not located on the surfaces read; the SRA addendum commits to an annual audit of security measures for those firms. Terms, security page and privacy policy excerpts read 6 September 2026.
AI Liability and Recourse
What the vendor stands behind contractually when its output is wrong. Indemnities, caps, carve outs, insurance, and whether any of it is published or only reachable through a negotiated agreement.
The allocation of loss is published and a buyer can read it, and it places nearly all of it on the buyer. Terms section 7 excludes all liability for loss from use of or reliance on the service, limits any claim for Actionstep's negligence or breach to the access fees paid in the previous twelve months, and makes termination the sole remedy for dissatisfaction; section 6.6 provides the service as-is with all warranties disclaimed, sections 6.3 to 6.5 exclude liability for regulatory penalties with the firm indemnifying Actionstep, and section 5.3 excludes liability for data loss. There is no vendor indemnity and no insurance; the SRA addendum alone gives an intellectual property non-infringement assurance and reasonable care and skill for those firms. Terms read in full 6 September 2026.
Practice Systems Integration Depth
How deeply the product reaches into the systems legal work already lives in: document management such as iManage and NetDocuments, Word and Outlook, contract lifecycle management, matter management, e-billing, and court filing systems.
Real integrations with depth described for some. The privacy policy describes the Google integration's scope, accessing and saving documents in Drive, saving email records and sending from Gmail, and displaying, creating and updating calendar appointments, and the vendor names Microsoft 365, QuickBooks Online, Xero and DocuSign; a public API with documented developer terms and rate limits exists. The integrations page was not opened and what a firm must configure is not recorded. Privacy policy excerpt, terms, developer terms and FAQ read 6 September 2026.
Deployment Model and Data Residency
Where the software runs and where the data sits. Multi tenant cloud, single tenant, private deployment, on premises, and whether region of residence is a published option or an enterprise conversation.
Regions and processing location are published and the tenancy model is not. Terms section 9.2 hosts the service on Amazon Web Services regions determined by the customer's data sovereignty requirements, section 9.4 lets the customer elect any AWS region Actionstep supports and commits to keep data on servers in that region while noting that user queries may carry some data outside it, and the SRA addendum fixes storage in the United Kingdom or European Union with twenty-eight days' notice of change. Nothing states whether customers share infrastructure, and the supported region list is not published on the surfaces read. Terms read 6 September 2026.
Security Certifications and Trust Center
Independent attestation a buyer can pull without a sales call: SOC 2, ISO 27001, penetration test summaries, a trust center with current reports and named scope rather than a badge image.
Certification is real and stated, short of a report reachable without asking. The vendor announces completion of a SOC 2 Type 2 examination with a badge dated February 2026 and states AWS hosting, multi-factor authentication, single sign-on and role-based permissions on its security page; the SRA addendum commits to an annual audit of security measures for those firms. No auditor, coverage period or report route was located on the surfaces read, and the announcement page was not opened. Terms footer, security page and announcement title read 6 September 2026.
Model Supply Chain Disclosure
Which models sit underneath, whose they are, where they run, and whether the vendor commits to telling customers when that changes. A legal buyer inherits every dependency it cannot see.
The vendor refers to third-party AI providers without identifying them. The AI page states that firm data is not shared with third-party AI providers in a way that exposes it beyond the firm, which acknowledges providers exist, and the terms say nothing about models; no model, provider, inference location or change-notification commitment is named on the surfaces read. The Actionstep Intelligence page and Trace page were not opened and are the rebuttal route. AI page and terms read 6 September 2026.
Commercial Transparency
Whether a buyer can learn what this costs without entering a sales process: published rates, the unit being charged, what sits behind an enterprise tier, and what implementation adds.
The unit and structure are stated without the figure on the surfaces read. The support centre states a base access fee covering up to three licences with per-user charges beyond that, and the terms bill subscription licences at the start of each subscription period with pro-rata additions, no refunds for prepaid periods and no credit for unused licences. A pricing page exists in the navigation and was not opened on 6 September 2026; a published figure there would lift this to A. Terms and support FAQ read 6 September 2026.
Firm and Practice Coverage
Who the product is actually built for. AmLaw, midlaw, small firm and solo, in house departments, government and courts, and which practice areas are supported rather than merely claimed.
Segment, practice and jurisdiction coverage are described with substance and the limits are unusually explicit. The vendor publishes pages for fourteen practice areas, six roles and midsize firms, contracts through entities in the United States, United Kingdom, Australia and New Zealand with jurisdiction-specific privacy policies and addenda, and states in its terms what the product does not do: it is not warranted for anti-money laundering compliance or for any jurisdiction's trust accounting rules, and firms must verify those themselves. Navigation and terms read 6 September 2026.
Legal Signals
What each signal meansA signal records what public sources say on the date shown. It is not a grade and it is not a recommendation. Where a signal reads Not addressed, it means the index did not locate the material in public sources on that date, which is a statement about disclosure rather than about the product.
Client Data in Training
Can material a lawyer puts into this product be used to train a model?
A public policy or trust page states no training on customer content, with no matching term located in the published agreement.
Public material states that customer content is not used to train, and no matching term was located in the published agreement. The AI page states that Actionstep does not use the firm's data to train AI models and that client, matter and billing data are not shared with third-party AI providers in a way that exposes them beyond the firm. The terms of use were read in full: section 5.2 licenses data to Actionstep only to provide the service, and no clause names training either way. A separately negotiated agreement prevails over the terms under section 10.2 and would be the place a contractual term could sit. Surfaces checked 6 September 2026.
Prompt and Output Retention
How long does the product keep what a lawyer typed, and can that be set to zero?
A specific retention period is published and the customer cannot change it.
A specific period is published and the customer cannot change it. Terms section 8.5 entitles Actionstep to delete all copies of data thirty days after termination, with a backup available on request within twenty days; the New Zealand addendum retains data for at least seven years during the agreement for tax purposes. Nothing states a shorter or configurable window for AI inputs and outputs during the term, and the AI page speaks of visibility and audit rather than retention. Surfaces checked 6 September 2026.
Ethical Walls and Matter Segregation
Does retrieval respect the firm’s ethical walls, or can the model read across them?
The product maintains its own permission model, documented, requiring the firm to keep it aligned.
The product maintains its own permission model and documents it at the level of a description. The security page describes role definition and per-user permissions with custom data collections restricted to selected users, and terms section 2 gives the subscriber control of each user's access level; nothing describes how the AI features respect those permissions when they act on matter data. Surfaces checked 6 September 2026.
Third Party Request and Subpoena Notice
If someone subpoenas the vendor for a firm’s data, does the firm hear about it first?
Published terms or policy address disclosure to authorities or in response to legal process, and no commitment or reservation regarding customer notice is located anywhere. The vendor has told the customer that data can leave and has said nothing about whether the customer hears of it.
Disclosure is addressed and notice is not reached. Terms section 4.1 preserves confidentiality of the other party's information except where required by law, with no commitment to tell the customer when its data is demanded; the SRA addendum separately authorises disclosure to the Solicitors Regulation Authority on request without prior consent. The jurisdiction-specific privacy policies incorporated by section 4.2 were not opened and are the rebuttal route. Surfaces checked 6 September 2026.
Primary Law Corpus Provenance
Where does the law in this product come from, and does the vendor have the right to use it?
No located public material identifies the corpus behind the product’s answers.
No located public material identifies a legal corpus behind the AI features, and the product is not built on one: Trace captures time from a user's activity and Actionstep Intelligence works from matter data, citing no law. AI page, home page and terms checked 6 September 2026.
Good Law Verification
Does the product tell you when the authority it just cited has been overruled?
No located public material addresses whether authority is checked for subsequent history.
No located public material addresses whether authority is checked for subsequent history, and the product does not retrieve or cite primary law. Recorded as the honest value for a product without a citator function. Surfaces checked 6 September 2026.
Refusal and Uncertainty Behaviour
What does the product do when the answer is not in the corpus?
No located public material addresses what the product does when it cannot ground an answer.
No located public material describes what the AI features do when they cannot ground an output. The AI page describes visibility and auditability of what the AI has done, which is a record rather than an abstention path, and no confidence signal is described. The Actionstep Intelligence page was not opened. AI page and terms checked 6 September 2026.
Fabricated Citation Record
Does a public court record exist involving output from this product?
No court order, opinion or disciplinary record naming this product has been located as of the date shown. This is a statement about the public record, not a finding about the product.
No court order, opinion or disciplinary record naming Actionstep, Actionstep Intelligence or Trace was located as of 6 September 2026. The AI Hallucination Cases database maintained by Damien Charlotin was searched on the company and product names together with a general search for court findings; results returned sanctions involving general-purpose chatbots and trackers, none of which names this product. This is a statement about the public record, not a finding about the product; a practice management tool whose AI captures time and surfaces matter data carries a remote exposure on this signal.
Bar Guidance Alignment
Has the vendor engaged in public with the ethics opinions its buyers are bound by?
Public materials engage with at least one named ethics opinion.
A specific regulator is named and the agreement is mapped to its requirements, for one jurisdiction and on outsourcing rather than AI. Terms section 11 is an addendum for firms regulated by the Solicitors Regulation Authority: it recognises the professional duties attaching to client data, waives any lien, fixes data location in the United Kingdom or European Union, gives twenty-eight days' notice of changes, commits to annual audit of security measures and to cooperation with the SRA. No guidance on lawyers' use of AI from any bar or regulator is named, and no equivalent addendum exists for the United States, Australia or New Zealand. Surfaces checked 6 September 2026.
Billing and Fee Posture
Does the vendor address what happens to the bill when the work takes an hour instead of six?
Public materials claim time savings without addressing billing or disclosure, and the product sits inside a fee relationship between a lawyer and a client where those savings would change the bill.
The buyer is a law firm and the product issues the client's invoice, so it sits inside the fee relationship; what it publishes on AI and the bill is time capture rather than disclosure. Trace passively captures billable time and Actionstep Intelligence is marketed as finding efficiency, and the vendor's own survey report frames AI as driving client demands for lower fees; nothing addresses how AI-assisted work is recorded or disclosed on the client's bill when the work takes less time. Home page, AI page and report title checked 6 September 2026.
Outside Counsel Guideline Readiness
Can a firm get this vendor through a client’s AI clause without a bespoke negotiation?
A current subprocessor or model provider list is published.
Service providers are named in the privacy policy without a model provider list. The privacy policy names Intercom and the scope of the Google integration, terms section 5.4 addresses data access by third-party applications a firm enables, and the AI page states that third-party AI providers exist and do not receive data in a way that exposes it beyond the firm, without naming them. The jurisdiction-specific privacy policies and any data processing agreement were not read in full and are the rebuttal route to a higher value. Surfaces checked 6 September 2026.
Court Disclosure Support
If a judge’s standing order requires an AI disclosure, can the product produce one?
Some elements of the record are available, short of a document level export.
Some elements of a disclosure record are available and no export is described. The AI page states that a firm can see what the AI has done and audit it, which is a record of AI actions inside the platform; nothing states that a per-document record of the model used, sources and human verification can be exported for a court, and the product produces no court-facing work product. AI page checked 6 September 2026.